[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: CVE For Services

To: "Millar, Thomas" <Thomas.Millar@hq.dhs.gov>, "Andy Balinsky (balinsky)" <balinsky@cisco.com>, "kseifried@redhat.com" <kseifried@redhat.com>
Subject: Re: CVE For Services
From: Art Manion <amanion@cert.org>
Date: Wed, 6 Sep 2017 09:52:41 -0400
Authentication-results: spf=none (sender IP is 129.83.29.3) smtp.mailfrom=LISTS.MITRE.ORG; mitre.mail.onmicrosoft.com; dkim=none (message not signed) header.d=none;mitre.mail.onmicrosoft.com; dmarc=none action=none header.from=cert.org;
Cc: cve-editorial-board-list <cve-editorial-board-list@LISTS.MITRE.ORG>
Delivery-date: Wed Sep 6 10:07:08 2017
Dkim-filter: OpenDKIM Filter v2.11.0 veto.sei.cmu.edu v86DqjQv034329
In-reply-to: <7748E4BAEC3B964387F3535351DCBA1F01153D8709@D2ASEPREA010>
List-help: <mailto:LISTSERV@LISTS.MITRE.ORG?body=INFO%20CVE-EDITORIAL-BOARD-LIST>
List-owner: <mailto:CVE-EDITORIAL-BOARD-LIST-request@LISTS.MITRE.ORG>
List-subscribe: <mailto:CVE-EDITORIAL-BOARD-LIST-subscribe-request@LISTS.MITRE.ORG>
List-unsubscribe: <mailto:CVE-EDITORIAL-BOARD-LIST-unsubscribe-request@LISTS.MITRE.ORG>
References: <164102EE-4473-42F6-A563-05DE00A50523@cisco.com> <55cf7646-6c2f-14ab-088d-e727afa0cba7@redhat.com> <2CC93EDD-F1E9-4DFD-A196-7885A9CEB92E@cisco.com> <7748E4BAEC3B964387F3535351DCBA1F01153D8709@D2ASEPREA010>
Sender: <owner-cve-editorial-board-list@lists.mitre.org>
Spamdiagnosticmetadata: 5952c28dcc454f0789fb433d26f936ef
Spamdiagnosticoutput: 1:2
User-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0) Gecko/20100101 Thunderbird/52.2.1

On 2017-09-06 09:35, Millar, Thomas wrote:

> 4. Plus whatever we said 6 months ago; I'm in transit so the archives 
> are not readily accessible

My recollection, human memory being what it is, was that it would be 
permissible to assign CVE IDs to service vulnerabilities, but that we 
didn't expect anything near comprehensive coverage, for reasons in this 
thread and others.  Also we didn't expect CVE or other CNAs to make a 
concerted effort to track service vulnerabilities (although, we didn't 
finish the bug bounty provider discussion).

About the legality of testing services:  While interesting, not 
directly CVE's problem.  Confirmation/evidence collection of service 
vulnerabilities will be much harder.

 - Art

Follow-Ups:
- RE: CVE For Services
  - From: Beverly Finch <beverlyfinch@lenovo.com>

References:
- CVE For Services
  - From: "Andy Balinsky (balinsky)" <balinsky@cisco.com>
- Re: CVE For Services
  - From: "kseifried@redhat.com" <kseifried@redhat.com>
- Re: CVE For Services
  - From: "Andy Balinsky (balinsky)" <balinsky@cisco.com>
- RE: CVE For Services
  - From: "Millar, Thomas" <Thomas.Millar@hq.dhs.gov>

Prev by Date: RE: CVE For Services
Next by Date: RE: CVE For Services
Previous by thread: RE: CVE For Services
Next by thread: RE: CVE For Services
Index(es):
- Date
- Thread