RE: Should be a CVE?

["Millar, Thomas" <Thomas.Millar@hq.dhs.gov>]

The issue is that some firmware versions thought to correct the 
original CVE - i.e. ones that end with a 4-digit sequence beginning 
with 3, per 
https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr:
 "Firmware versions that resolve the issue have a four digit build 
number that starts with a "3" (X.X.XX.3XXX)" - are actually the source 
of the problem in the newer CVE. So you think you're out of the woods, 
but a local admin can still "upgrade" to a vulnerable version. 

It may warrant a separate CVE since this is a separate thing you would 
need to do discovery for and remediate even if you had followed the 
prior recommendations in SA-00075.  



-----Original Message-----
From: owner-cve-editorial-board-list@lists.mitre.org 
[mailto:owner-cve-editorial-board-list@lists.mitre.org] On Behalf Of 
Beverly Finch
Sent: Tuesday, September 12, 2017 3:37 PM
To: Waltermire, David A. (Fed) <david.waltermire@nist.gov>; 
cve-editorial-board-list@lists.mitre.org
Subject: RE: Should be a CVE?

I agree.



Regards, 


Beverly M Finch, PMP
PSIRT Program Manager
Product Security Office

7001 Development Drive
Office 3N-C1
Morrisville, NC  27560

+1 919 294 5873
beverlyfinch@lenovo.com



Lenovo.com 
Twitter | Facebook | Instagram | Blogs | Forums






-----Original Message-----
From: owner-cve-editorial-board-list@lists.mitre.org 
[mailto:owner-cve-editorial-board-list@lists.mitre.org] On Behalf Of 
Waltermire, David A. (Fed)
Sent: Tuesday, September 12, 2017 3:20 PM
To: cve-editorial-board-list@lists.mitre.org
Subject: Should be a CVE?

Looking at the following, it appears that a CVE was issued for the 
potential that someone might upgrade software to a vulnerable version, 
which has another CVE. I don't think this should qualify as a CVE, 
given the actual vulnerability already has one. 

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5698

Should this CVE be rejected?

Regards,
Dave