Re: CVE's for private/"Secret" issues

[Kurt Seifried <kseifried@redhat.com>]

On Thu, Nov 19, 2015 at 10:28 AM, jericho <jericho@attrition.org> wrote:

I understand that such a company does not want to give any information
away about their 0day, as that is a huge part of their reputation (and
thus sales). What I don't understand is that when they release a dozen
exploits for already disclosed issue, they don't match them up with a CVE
if one exists. Why tell people "we can exploit a remote WordPress flaw"
that we know is public, but not which one? As a customer I would certainly
want to know that. But, it may be a case where the actual exploit
references it, and the public list of exploits released in that version /
pack do not. Makes sense for existing customers, but seems like missing
out on potential sales as vague descriptions like that are not very
helpful.

Thinking of economic incentives I suspect this is due to the fact that 1) why bother doing the work internally when you can get the community to do it and match it up and 2) by not attaching CVE's they make the work look potentially original as opposed to "this is old and well known". 

 

HP's TippingPoint ZDI does use CVE for a majority of their issues, and
they are also very good about answering questions if there is confusion
over assignments or which issue it tracks to in relation to a vendor
advisory. I routinely email them and appreciate their help when it comes
up.

In general, most that I have spoken to consider CVE assignment as either
no benefit, or possibly hurting them competitively. Further, from their
eyes, what is the value if they have no plans to ever release details, and
never verify it is a duplicate to another disclosure?

Again the economics for the 0 day as attack tools sellers are definitely incentivized against any public disclosure or getting these issues fixed by vendors sadly. 

So rather then trying to deal with the 0 day sellers perhaps we get their customers to demand CVE's. Is there any Mitre program/materials to educate consumers (e.g. companies) of the value of CVE?

--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert@redhat.com