id entr
y_tim
esta
mp_queue
entr
y_tim
esta
mp_cre
ate
entr
y_tim
esta
mp_change
entr
y_m
ain
tain
er_
queue
entr
y_m
ain
tain
er_
cre
ate
entr
y_m
ain
tain
er_
change
entr
y_changelo
g
entr
y_sm
ss
softw
are
_ty
pe
softw
are
_vendor
softw
are
_nam
e
softw
are
_vers
ion
softw
are
_pla
tform
softw
are
_com
ponent
softw
are
_fil
e
softw
are
_lib
rary
softw
are
_fu
nctio
n
softw
are
_arg
um
ent
softw
are
_in
put_
type
softw
are
_in
put_
valu
e
softw
are
_w
ebsite
softw
are
_affecte
dlis
t
softw
are
_advis
ory
quote
softw
are
_fr
eete
xt_
de
softw
are
_fr
eete
xt_
en
vuln
era
bility
_dis
covery
date
vuln
era
bility
_vendorinfo
rmdate
vuln
era
bility
_cla
ss
vuln
era
bility
_im
pact
vuln
era
bility
_risk
vuln
era
bility
_sim
plic
ity
vuln
era
bility
_popula
rity
vuln
era
bility
_his
toric
vuln
era
bility
_cvss_av
vuln
era
bility
_cvss_ac
vuln
era
bility
_cvss_au
vuln
era
bility
_cvss_ci
vuln
era
bility
_cvss_ii
vuln
era
bility
_cvss_ai
vuln
era
bility
_tit
lew
ord
vuln
era
bility
_keyw
ord
s
vuln
era
bility
_sourc
ecode
vuln
era
bility
_advis
ory
quote
vuln
era
bility
_fr
eete
xt_
de
vuln
era
bility
_fr
eete
xt_
en
advis
ory
_date
advis
ory
_lo
catio
n
advis
ory
_ty
pe
advis
ory
_url
advis
ory
_via
advis
ory
_id
entif
ier
advis
ory
_re
port
confid
ence
advis
ory
_coord
inatio
n
advis
ory
_pers
on_nam
e
advis
ory
_pers
on_nic
knam
e
advis
ory
_pers
on_m
ail
advis
ory
_pers
on_w
ebsite
advis
ory
_com
pany_nam
e
advis
ory
_confir
m_url
advis
ory
_confir
m_date
advis
ory
_dis
pute
d
advis
ory
_advis
ory
quote
advis
ory
_fr
eete
xt_
de
advis
ory
_fr
eete
xt_
en
explo
it_availa
bility
explo
it_date
explo
it_public
ity
explo
it_url
explo
it_develo
per_
nam
e
explo
it_develo
per_
nic
knam
e
explo
it_develo
per_
explo
it_develo
per_
website
explo
it_la
nguage
explo
it_explo
itability
explo
it_re
liability
explo
it_w
orm
ified
explo
it_google
hack
explo
it_advis
ory
quote
explo
it_sourc
ecode
explo
it_fr
eete
xt_
de
explo
it_fr
eete
xt_
en
counte
rmeasure
_re
media
tionle
vel
counte
rmeasure
_nam
e
counte
rmeasure
_date
counte
rmeasure
_re
liability
counte
rmeasure
_upgra
de_vers
ion
counte
rmeasure
_upgra
de_url
counte
rmeasure
_patc
h_nam
e
counte
rmeasure
_patc
h_url
counte
rmeasure
_config
_settin
g
counte
rmeasure
_fir
ew
alling_port
counte
rmeasure
_auth
entic
atio
n_nam
e
counte
rmeasure
_encry
ptio
n_nam
e
counte
rmeasure
_w
ork
aro
und
counte
rmeasure
_w
ork
aro
und_url
counte
rmeasure
_alte
rnativ
e_nam
e
counte
rmeasure
_sourc
ecode
counte
rmeasure
_advis
ory
quote
counte
rmeasure
_fr
eete
xt_
de
counte
rmeasure
_fr
eete
xt_
en
sourc
e_osvdb
sourc
e_osvdb_cre
ate
sourc
e_osvdb_tit
le
sourc
e_cve
sourc
e_cve_assig
ned
sourc
e_secunia
sourc
e_secunia
_tit
le
sourc
e_secunia
_risk
sourc
e_security
focus
sourc
e_security
focus_tit
le
sourc
e_sectr
acker
sourc
e_sectr
acker_
title
sourc
e_vupen
sourc
e_xfo
rce
sourc
e_xfo
rce_tit
le
sourc
e_xfo
rce_id
entif
ier
sourc
e_xfo
rce_risk
sourc
e_securite
am
sourc
e_explo
itdb
sourc
e_heis
e
sourc
e_te
cchannel
sourc
e_nessus_id
sourc
e_nessus_nam
e
sourc
e_nessus_risk
sourc
e_nessus_fa
mily
sourc
e_nessus_ty
pe
sourc
e_nessus_port
sourc
e_nessus_date
sourc
e_atk
sourc
e_snort
_id
sourc
e_snort
_m
essage
sourc
e_snort
_pattern
sourc
e_tip
pin
gpoin
t_id
sourc
e_tip
pin
gpoin
t_tit
le
sourc
e_tip
pin
gpoin
t_cate
gory
sourc
e_vid
eolin
k
sourc
e_m
isc
legacy_tit
le
legacy_affecte
d
legacy_descriptio
n
legacy_expert
Adventures in a Decade of Tracking and Consolidating Security Vulnerabilities
Marc Ruef
www.scip.ch
area41 Security Conference June 2014, Zürich, Switzerland
Agenda | Vulnerability Database Maintenance
1. Intro
Introduction 2 min
Who am I? 2 min
What is the Goal? 2 min
2. Vulnerability Database Maintenance
Design the Database 5 min
Handling of Sources 4 min
Interpretation of Data 4 min
Correlation of Data 4 min
Quality Management 5 min
Extrapolation of Data 5 min
Deliver your Results 5 min
Statistical Analysis 5 min
Provide Accessibility 5 min
Use Connectivity 5 min
3. Outro
Summary 2 min
Questions 5 min
area41 2014 2/34
Introduction | Who Am I?
Name Marc Ruef
Job Co-Owner / CTO, scip AG, Zürich
Private Website http://www.computec.ch
Last own Book „The Art of Penetration Testing“, Computer & Literatur Böblingen, ISBN 3-936546-49-5
Translation
area41 2014 3/34
2013 2007 2002 2004
Introduction | What Is a Vulnerability Database?
◦ What?
◦ A database collecting vulnerabilities
◦ Why?
◦ To do vulnerability management
◦ What is vulnerable?
◦ What is to patch?
◦ To do statistical analysis
◦ Costs of patch management
◦ Robustness of products
area41 2014 4
Introduction | scip VulDB Looks like This (Overview)
area41 2014 5
Introduction | scip VulDB Looks like This (Detail)
area41 2014 6
Design | What Should Your Vulnerability Database Do?
◦ How much?
◦ Full coverage
◦ Selective collection
◦ Inventory-only
◦ Vendor-selection
◦ Importance threshold
◦ Fixed only
◦ For whom?
◦ Everyone
◦ Public service
◦ Advertisement
◦ Customers
◦ Vulnerability management service
◦ Alerting service
◦ Tools
◦ Internal Use
◦ Knowledge-base
◦ For pentesters
◦ For administrators
area41 2014 7
Design | What Is an Entry?
◦ A VDB entry consists of different elements. Minimal elements usually are:
◦ ID 12413
◦ Title Linux Low-Address Protection Denial of Service
◦ Disclosure Date 02/21/2014
◦ Description A vulnerability, classified as (…)
◦ Risk Rating problematic
◦ References CVE-2014-2039, BID 65700, …
area41 2014 8
Design | Details Are Cool…
◦ Entry
◦ Software
◦ …
◦ Vulnerability
◦ …
◦ Advisory
◦ …
◦ Exploit
◦ Availability → yes|no
◦ Publicity → public|private
◦ Disclosure Date → yyyyMMdd
◦ Developer → $name
◦ Language → Ruby|Python|C|…
◦ Reliability → low|medium|high
◦ …
◦ Countermeasure
◦ …
◦ Sources
◦ …
◦ Tools
◦ …
◦ Misc
◦ …
area41 2014 9
Design | But Details Take Time!
◦ We have compiled more than 13’400 entries since 2003
◦ A scip VulDB entry consists of ~150 possible data points
◦ We rate data points to prioritize:
◦ Important = 33 (must be processed if available)
◦ Normal = 32 (shall be processed)
◦ Optional = 85 (can be processed, if you have «too much time»)
◦ Statistical analysis of defined data points over all entries:
◦ Average = 49.92
◦ Min = 26
◦ Max = 90
◦ We currently add ~15 new entries per day (work-days only)
area41 2014 10
Sources | Possible Sources
◦ Vulnerability databases
◦ Vulnerability contributors (iDefense VCP, HP ZDI)
◦ Infosec mailinglists
◦ Vendor mailinglists
◦ Vendor advisories
◦ Code repositories
◦ News
◦ Blogs
◦ Social networks (e.g. Twitter, G+, LinkedIn)
◦ Friends, colleagues, co-workers, …
area41 2014 11
Sources | Vulnerability Databases: Advantages and Disadvantages
VDB Pros Cons
IBM X-Force http://xforce.iss.net
• Good coverage • CVSSv2 base scores • CVSSv2 temporal scores • CVE support
• Sometimes a bit slow (2-3 updates per week)
• «Arbitrary» listing (default view: 5 entries, no backlog)
• No RSS feed
OSVDB http://www.osvdb.org
• Very quick (daily updates) • Best coverage (everything!) • CVSSv2 base scores (via MITRE) • CVE support
• No listing (since Feb 2014) • No own risk rating (CVSSv2 only) • No RSS feed (since 2012)
Secunia http://secunia.com/community/advisories/historic/
• Good coverage • Good listing (default view: 25 entries) • CVE support
• Login required (since Apr 2014) • Some details for paying customers only • Combining multiple vulnerabilities in
one entry (by release/patch) • They don’t like other projects (they
forbade to use their listing for vulscan.nse in 2013)
• No RSS feed • No CVSSv2 scores
SecurityFocus http://www.securityfocus.com/bid
• Good coverage • CVE support
• Listing also shows updated entries (default view: 31 entries)
• Site is slow • Data for an entry is spread over 5 sub-
pages • No CVSSv2 scores
SecurityTracker http://securitytracker.com
• Sometimes quite quick • Simple listing (default view: 5 entries) • CVE support
• Selective coverage (popular products only)
• No CVSSv2 scores
Sources | Evaluation Rating Introduction
◦ Criteria are those we think are important
◦ We have addressed them as far as possible in our project (because of this prioritization)
◦ Rating is as fair as possible
◦ You might rate a bit differently
Description Rati
ng
Feature is supported: always/fully 3
Feature is supported: often/partially 2
Feature is supported: sometimes/somehow 1
Feature is never/not supported 0
Sources | Vulnerability Databases: Rating
VDB Co
verag
e
(how
much)
Qu
ickn
ess
(how
fast)
Lis
tin
g
(how
vis
ible
)
Search
(h
ow
searc
hable
)
Han
dlin
g
(how
erg
onom
ic)
Tech
Deta
ils
(how
deta
iled)
Ris
k R
ati
ng
(h
ow
measure
d)
CV
SS
B
ase
CV
SS
Tem
po
ral
CV
E
Feed
s
(how
accessib
le)
To
tal
CERT VU http://www.kb.cert.org/vuls/
1 3 3 2 2 3 0 3 3 3 3 26
Exploit-DB http://www.exploit-db.com
1 3 3 3 2 2 0 0 0 3 3 20
IBM X-Force http://xforce.iss.net
3 1 1 1 2 2 0 3 3 3 0 19
NIST NVD http://nvd.nist.gov
2 1 3 3 2 2 0 3 0 3 3 22
MITRE CVE http://cve.mitre.org
2 1 3 2 2 2 0 0 0 3 2 17
OSVDB http://www.osvdb.org
3 3 0 2 2 2 0 2 0 3 0 17
Secunia http://secunia.com/community/advisories/historic/
3 2 3 3 2 2 3 0 0 3 0 21
SecurityFocus http://www.securityfocus.com/bid
3 2 2 2 1 2 0 0 0 3 0 15
SecurityTracker http://securitytracker.com
1 2 3 2 3 2 0 0 0 3 0 16
scip VulDB (rating ourselves comes with bias)
http://www.scip.ch/en/?vuldb 2 2 3 2 3 3 3 3 3 3 3 30
2.1 2.0 2.4 2.2 2.1 2.2 0.6 1.4 0.9 3.0 1.4
Sources | Vulnerability Databases: Conclusion
◦ Being quick is not easy
◦ Technical details range from bad to good
◦ CVSS scores are pretty unpopular, especially «temporal scores»
◦ CVE has been established as the de facto standard (nice!)
◦ You can’t compare CERT VU, Exploit-DB, NIST NVD and MITRE CVE with anything else
◦ Exploit-DB inherits abstraction from researchers and is not self-consistent
◦ Secunia and SecurityFocus are very similar in many aspects
◦ X-Force and SecurityTracker remain pretty unpopular
◦ The «O» in OSVDB does not stand for «open» anymore
◦ Some features have been broken for ages (e.g. search on OSVDB and X-Force)
◦ Not everyone is a big fan of feeds
area41 2014 15
Sources | Vendor Advisories: Advantages and Disadvantages
Vendor Pros Cons
Adobe http://helpx.adobe.com/security.html
• Product-related listing • Some technical details • Priority rating • CVE support
• Advisory per release/upgrade • No RSS feed
Apple • Simple technical details • CVE support
• No risk rating • No CVSSv2 scores • No listing • Advisory per release/upgrade • No RSS feed
Cisco https://tools.cisco.com/security/center/publicationListing.x
• Advisory listing • Advisory per vulnerability • Sometimes additional technical details • CVSSv2 base scores • CVE support
• Technical details with login only • Some details for customers only • No RSS feed
Google • CVE support • No listing • Advisory per release/upgrade • Technical details with auth only • No risk rating • No CVSSv2 scores • No RSS feed
Microsoft http://technet.microsoft.com/security/advisory
• Some technical details • Listing (default view: 5 entries) • RSS feed
• Patch day collection (2nd Tuesday of each month)
• Severity rating • No CVSSv2 scores
Oracle http://www.oracle.com/technetwork/topics/security/alerts-086861.html
• Simple listing • CVSSv2 base scores • CVE support
• Patch day collection (quarterly) • No technical details • No RSS feed
Sources | Vendor Advisories: Rating
Vendor Vu
ln I
D
(how
uniq
ue)
Freq
uen
cy
(how
fast)
Lis
tin
g
(how
vis
ible
)
Tech
Deta
ils
(how
deta
iled)
Ris
k
(how
measure
d)
CV
SS
B
ase
CV
SS
Tem
po
ral
CV
E
RS
S
To
tal
FortiGuard http://www.fortiguard.com/advisory/
3 3 3 3 3 0 0 3 3 21
Symantec http://www.symantec.com/security_response/securityupdates/list.jsp
3 3 3 3 0 3 0 3 3 21
Microsoft http://technet.microsoft.com/security/advisory
3 2 3 3 3 0 0 3 3 20
Checkpoint https://www.checkpoint.com/defense/advisories/public/summary.html
3 2 3 2 3 0 0 3 3 19
Cisco https://tools.cisco.com/security/center/publicationListing.x (details auth only)
3 3 3 3 0 3 0 3 0 18
Oracle http://www.oracle.com/technetwork/topics/security/alerts-086861.html
1 1 3 1 3 3 0 3 3 18
Adobe http://helpx.adobe.com/security.html
3 3 3 2 2 0 0 3 0 16
HP https://h20566.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive
3 3 3 1 0 3 0 3 0 16
SAP https://service.sap.com/sap/support/notes/ (auth only)
3 3 3 2 3 2 0 0 0 16
D-Link http://securityadvisories.dlink.com/security/
3 3 2 2 0 0 0 2 0 12
Google http://www.google.com (details auth only)
3 3 1 2 0 0 0 3 0 12
Apple http://www.apple.com
1 2 1 1 0 0 0 3 0 8
2.66 2.58 2.58 2.08 1.41 1.16 0.0 2.66 1.25
Sources | Vendor Advisories: Conclusion
◦ Some vendors have really ugly advisory URLs
◦ Technical details range from bad to good
◦ CVSS scores are pretty unpopular, especially «temporal scores»
◦ Own risk ratings are also unpopular, because they are hard
◦ Nearly everybody likes CVE
◦ Microsoft and Oracle handle things better than it felt
◦ Juniper has a field «Last Updated» but no «Disclosure Date»
◦ SAP is very restrictive with information for non-customers, which introduces a severe disadvantage (VDB’s can’t categorize them, which decreases visibility)
◦ Vendors aren’t big fans of RSS feeds either
area41 2014 18
Sources | Vuln Contributors: Advantages and Disadvantages
Project Pros Cons
iDEFENSE Vulnerability Contributor Program http://www.verisigninc.com/en_US/cyber-security/index.xhtml
• Started in 2003 • Incomplete listing • No announcement of upcoming
advisories • No CVSSv2 support • No search capabilities • No RSS feed • All old links are broken since
Zero Day Initiative http://www.zerodayinitiative.com
• Provide announcement for upcoming advisories
• Provide CVSSv2 Base Scores • RSS feeds available
• No search capabilities
Sources | Vuln Contributors: Rating
Project Lis
tin
g
(how
vis
ible
)
Search
(h
ow
searc
hable
)
Han
dlin
g
(how
erg
onom
ic)
Tech
Deta
ils
(how
deta
iled)
Ris
k R
ati
ng
(h
ow
measure
d)
CV
SS
B
ase
CV
SS
Tem
po
ral
CV
E
RS
S
To
tal
iDEFENSE Vulnerability Contributor Program http://www.verisigninc.com/en_US/cyber-security/index.xhtml
3 0 3 2 0 0 0 3 0 11
Zero Day Initiative http://www.zerodayinitiative.com
3 0 3 2 0 3 0 3 3 17
3.0 0.0 3.0 2.0 0.0 1.5 0.0 3.0 1.5
Sources | Vuln Contributors: Conclusion
◦ Only 2 major players
◦ They are quite similar in most aspects
◦ Zero Day Initiative has 2 advantages of CVSSv2 and RSS support
◦ More competition might increase quality
area41 2014 21
Interpretation | How to Analyze
◦ The basic approach of processing a source is simple:
1. Check source for new entries
2. Review source entry
3. Add necessary data to database
1. If entry is available → Update existing entry
2. If entry is not available → Create new entry
3. If source is false-positive → Ignore entry and flag for future reference
4. Goto 1
area41 2014 22
Interpretation | MITRE CVE as an Example
cve
description
advisory
cert vu
software
Interpretation | MITRE CVE as an Example: What Is missing?
◦ What’s missing on a MITRE CVE entry?
◦ Disclosure date
◦ Exact naming of vulnerability class
◦ Risk rating
◦ Person responsible for disclosure
◦ Detailed mitigation/countermeasure
◦ …
area41 2014 24
Interpretation | OSVDB as an Example
cve sectracker
product version
description
date
exploit
news
Interpretation | Contradicting Conventions (Disclosure Date)
02/19/2014
02/26/2014
Interpretation | Contradicting Conventions (Disclosure Date)
CVE-2014-2284
net-snmp 5.7.1 on Linux ICMP-MIB Denial of Service
02/1
9/2
014
02/2
0/2
014
02/2
1/2
014
02/2
2/2
014
02/2
3/2
014
02/2
4/2
014
02/2
5/2
014
02/2
6/2
014
02/2
7/2
014
...
03/2
4/2
014
Sourc
eF
org
e
Rele
ase N
ote
SecF
ocus
SecT
racker
VulD
B
OS
VD
B
Secunia
Red H
at
Our definition of a (public) disclosure date:
The earliest known date to
disclose an issue to the public in an unrestricted way.
(we’re going to adopt a more differentiated approach in the
near future)
03/0
5/2
014
oss-s
ecurity
...
CV
E
Interpretation | Put the Different Pieces Together
VDB Pro
du
ct
Versio
n
Vu
ln C
lass
Dis
clo
su
re
Date
Ad
vis
ory
UR
L
Att
ack
Co
nte
xt
Exp
loit
So
luti
on
Vu
lnD
B
So
urces
Mis
c.
Lin
ks
To
tal
CERT VU http://www.kb.cert.org/vuls/
3 2 3 2 3 3 1 3 0 1 21
Exploit-DB http://www.exploit-db.com
3 2 2 2 2 1 3 1 1 0 17
IBM X-Force http://xforce.iss.net
3 2 2 3 2 3 1 2 2 2 22
NIST NVD http://nvd.nist.gov
2 2 3 0 3 1 1 1 3 3 19
MITRE CVE http://cve.mitre.org
2 2 2 0 3 1 1 1 3 3 18
OSVDB http://www.osvdb.org
3 3 3 3 3 3 3 3 3 3 30
Secunia http://secunia.com/community/advisories/historic/
2 2 2 2 3 1 1 2 0 0 15
SecurityFocus http://www.securityfocus.com/bid
3 3 3 3 2 1 2 2 0 1 20
SecurityTracker http://securitytracker.com
3 3 3 1 2 3 1 3 0 1 20
scip VulDB http://www.scip.ch/en/?vuldb
3 3 3 3 3 3 3 3 3 3 30
2.7 2.4 2.6 1.9 2.6 2.0 1.7 2.1 1.5 1.7
Sources | Vulnerability Databases: Conclusion
◦ OSVDB provides the best collection of data
◦ Secunia provides the worst collection of data
◦ SecurityFocus and Secunia usually don’t provide context
◦ X-Force, SecurityTracker and Secunia don’t provide exploit details
◦ SecurityTracker and Secunia have confusing disclosure dates
◦ SecurityFocus, SecurityTracker and Secunia don’t link to other VDB
area41 2014 29
Correlation | That's Why You Have to Correlate
◦ Approach
◦ Merge different sources
◦ Compare similar data points
◦ Identify and verify contradictions
◦ Dangers
◦ Duplicates: Come up with annoying inconsistency
◦ Merges: Come up with dangerous mashups
area41 2014 30
Correlation | Now Things Are Getting Tricky
◦ Sometimes vulnerabilities can’t be identified individually
◦ CVE helps a lot! But not every vulnerability (immediately) has a CVE number
◦ Some sources merge vulnerabilities into one entry
◦ Vendors do this within their patch release notes or patch days
◦ Secunia tends to compile different vulnerabilities of the same day or patch generation into one entry (e.g. 58519). SecurityFocus does it sometimes (e.g. 67553) and so does SecurityTracker in some cases (e.g. 1030269).
◦ Vulnerabilities with very few technical details often can’t be distinguished from similar vulnerabilities (e.g. Apple HT6145: no info available, but CVE assigned)
area41 2014 31
Correlation | Keep Track, Detect Collisions
◦ Keep track of your sources and the entries already reviewed
◦ Verify that every new entry is really new and not just a duplicate or a minor fork of an existing entry. This is a very underestimated task!
◦ We do that with collision detection
◦ Compare new values with existing values of other entries (e.g. URLs, IDs, references). If there is a specified level of matches, we have to check for a duplicate.
◦ Our reference maps help to distinguish. Projects like vFeed support this very good. [https://github.com/toolswatch/vFeed/]
area41 2014 32
Correlation | To Split or Not to Split
Parameter
→ 5 entries
File
→ 4 entries
Component
→ 3 entries
Vuln Class
→ 2 entries
Advisory/Patch
→ 1 entry
Advisory #VA42
Cross Site Scripting
User Auth login.php
login_user
login_pass
News Portal
news.php news_id
archive.php news_year
SQL Injection
Board forum.php post_id
area41 2014 33
Correlation | Split Example (MS Patch Day, IE Vuls, Feb 2014)
VulDB
(vuln split)
SecFocus*
(vuln split)
CVE
(vuln split)
Secunia
(combined)
Microsoft (combined)
MS14-010 SA56796
CVE- 2014-0267
BID 65361 SID 12242
CVE- 2014-0268
BID 65392 SID 12239
… … …
CVE- 2014-0293
BID 65394 SID 12241
area41 2014 34
* SecurityFocus often combines (e.g. BID 67553)
Correlation | Unwanted Split (cPanel, Dec 2013)
◦ TSR 2013-0011, http://cpanel.net/tsr-2013-0011-full-disclosure/ ◦ 12/18/2013 cPanel WHM Reseller Login Handler Cookie information disclosure
◦ 12/18/2013 cPanel WHM Login Security Handler Token information disclosure
◦ 12/18/2013 cPanel WHM Branding Subsystem privilege escalation
◦ 12/18/2013 cPanel WHM usr/local/cpanel/share/counter privilege escalation
◦ 12/18/2013 cPanel WHM Daily Process Log Screen Stored cross site scripting
◦ 12/18/2013 cPanel WHM cPAddons Upgrade Handler Password information disclosure
◦ 12/18/2013 cPanel WHM Edit DNS Zone Interface information disclosure
◦ 12/18/2013 cPanel WHM SSH Authentication Handler privilege escalation
◦ 12/18/2013 cPanel WHM X3 Theme countedit.cgi Directory Traversal
◦ 12/18/2013 cPanel WHM Bandmin passwd privilege escalation
◦ 12/18/2013 cPanel WHM cpsrvd Bypass privilege escalation
◦ 12/18/2013 cPanel WHM Bandmin Reflected cross site scripting
◦ 12/18/2013 cPanel WHM API Call Handler UI::dynamicincludelist Directory Traversal
◦ 12/18/2013 cPanel WHM Database Handler privilege escalation
◦ 12/18/2013 cPanel WHM Backup Archive Handler privilege escalation
◦ 12/18/2013 cPanel WHM Config Handler Cross Site Request Forgery
◦ 12/18/2013 cPanel WHM Translatable Phrase Handler Locale::Maketext privilege escalation
◦ 12/18/2013 cPanel WHM CSRF Protection Bypass Cross Site Request Forgery
◦ 12/18/2013 cPanel WHM cross site scripting
◦ 12/18/2013 cPanel WHM Logaholic Session File Handler /tmp privilege escalation
◦ 12/18/2013 cPanel WHM Virtualhost Installation Handler privilege escalation area41 2014 35
Correlation | Split Pros and Cons
◦ Advisory / Patch
◦ Few entries
◦ Good for overview
◦ Good for patch management
◦ Vulnerability
◦ Some entries
◦ Possible splits for 3rd party components
◦ Element
◦ A lot of entries
◦ Good for statistical analysis
area41 2014 36
Quality | How to Provide the Best?
◦ Try to verify statements from researchers, vendors and vulnerability database maintainers
◦ Check for plausibility
◦ Verify from other sources
◦ Re-test within a lab
◦ Eliminate wrong statements
◦ Delete false entries
◦ Preserve false entries (prefered by CVE, SecurityFocus)
◦ Add further explanations
◦ Flag (prefered by OSVDB, scip VulDB)
◦ advisory_disputed=1 (e.g. scipID 13305, 13000, 12643)
◦ advisory_reportconfidence=UR (CVSSv2 temp score metric)
◦ Try to find and compile additional details
area41 2014 37
Extrapolation | Versions of Affected Software
◦ Exact Version
◦ Internet Explorer 10 → X-Force, OSVDB, SecFocus, Secunia, VulDB
◦ Wildcards
◦ Internet Explorer 6.x → Secunia, SecFocus, SecTracker, VulDB
◦ Ranges
◦ Internet Explorer 8 – 10 → Secunia, CVE
◦ Internet Explorer prior 10 → SecurityTracker, Secunia
◦ Internet Explorer before 10 → CVE
◦ Internet Explorer up to 10 → VulDB
◦ Internet Explorer 8 and later → SecurityTracker
area41 2014 38 10 11 9 8 7 6
10
up to 10
8 to 10
Internet Explorer Versions
before 10
…
Extrapolation | What about The Unknown?
◦ Try to guess. Examples:
◦ «IE prior 9» → 6 – 9
◦ «IE prior 11» → 7 – 10
◦ Research and validate yourself
◦ A lot of work
◦ We combine with other projects (research or pentest)
◦ We enforce very important or interesting vulnerabilities
◦ Be quiet
area41 2014 39
Delivery | Chose your Channels
◦ Web Site
◦ RSS
◦ Widgets
◦ App
◦ …
area41 2014 40
Statistics | Comparing Apples and Oranges
◦ Doing some statistics is easy. Doing it the right way is hard. Some say it is even impossible. [http://blog.osvdb.org/category/vulnerability-statistics/]
◦ Counting vulnerabilities doesn’t say anything:
◦ Weak code leads to a lot of vulnerabilities
◦ Complexity leads to a lot of vulnerabilities
◦ Popularity leads to a lot of vulnerabilities
◦ Bug bounty programs lead to a lot of vulnerabilities
◦ Open disclosure process leads to a lot of vulnerabilities
◦ We still provide statistical raw data and expect the viewers to think about it
area41 2014 41
Statistics | Timelines Are Interesting
◦ Our timelines consist of multiple data points
◦ vulnerability_introduction_date
◦ vulnerability_discovery_date
◦ vulnerability_vendorinform_date
◦ advisory_date
◦ advisory_confirm_date
◦ exploit_date
◦ countermeasure_date
◦ source_cve_assigned
◦ source_secunia_date
◦ source_nessus_date
◦ entry_timestamp_create
◦ entry_timestamp_update
Example Heartbleed [CVE-2014-0160]
area41 2014 42
Statistics | Timelines Trivia (excerpt from 2014)
◦ [CVE-2014-0160] OpenSSL TLS/DTLS Heartbeat information disclosure got introduced in 01/01/2012 and fixed in 04/07/2014
◦ existed 827 days
◦ [CVE-2014-0179] libvirt XML Entity Expansion Handler denial of service got introduced in 12/23/2009 and fixed in 05/06/2014
◦ existed 1.595 days
◦ [CVE-2014-3122] Linux Kernel try_to_unmap_cluster() denial of service got introduced in 10/19/2008 and fixed in 04/10/2014
◦ existed 1.996 days
◦ [CVE-2014-3460] Novell NetIQ Sentinel Agent Manager directory traversal vendor got informed in 09/04/2013 but did not respond until 05/19/2014
◦ Novell ignored grace period of 257 days
area41 2014 43
Accessibility | Choose Additional Representation
◦ To allow users to work with your data, it might be the best way to provide additional forms of representation:
◦ SQL
◦ XML
◦ JSON
◦ CSV
◦ CVRF [http://www.icasi.org/cvrf]
area41 2014 44
Connectivity | Use Data for Vuln Scanning
◦ We are able to construct specific requests with our fields software_argument and software_input_value to create test cases and exploits (very simple for web-based vulns)
◦ Because of the fields software_* we are able to provide CPE lists [http://cpe.mitre.org/], which can be matched with tools like Nmap. Random examples:
◦ ID 12313 → cpe:/a:sap:netweaver:7.30
◦ ID 12802 → cpe:/o:cisco:ios:15.4(1.1)t
◦ ID 13306 → cpe:/a:microsoft:internet_explorer:8
area41 2014 45
Outro | Summary
◦ Vulnerability databases help to manage vulnerabilities
◦ Different sources allow to collect a broad amount of issues
◦ Every source has some advantages and disadvantages
◦ Compiling and maintaining vulnerabilities takes a lot of effort
◦ Making your data accessible helps others
area41 2014 46
Outro | Thank You
◦ I‘d like to thank a bunch of people which helped to discuss the many interesting aspects of vulnerability database management:
◦ Stefan Friedli, scip AG
◦ Steven M. Christey, MITRE
area41 2014 47
Outro | Questions
area41 2014 48
Security Is Our Business!
scip AG
Jakob-Fügli-Strasse 18
CH-8048 Zürich
Tel +41 44 404 13 13
Fax +41 44 404 13 14
Mail [email protected]
Web http://www.scip.ch
Twitter http://twitter.com/scipag
Strategy | Consulting
Auditing | Testing
Forensics | Analysis
area41 2014 49