|
|
tags:
all,
apache,
apachecon,
apacheweek,
bryce,
cve,
fedora,
fudcon,
geocaching,
gps,
ha,
jabber,
metrics,
microsoft,
nashville,
north carolina,
oscon,
red hat summit,
security,
trips
|
|
|
mark :: blog
Back in
August I found that many of the Common Vulnerability Scoring
System (CVSS) scores that the National Vulnerability Database (NVD)
assigned to vulnerabilities affecting open source software were incorrect.
Since then I've been sending in corrections on a monthly basis,
taking into account the worst possible score across all affected
platforms (and not how Red Hat products were affected specifically).
For the five months May to September 2007 I looked at 178
vulnerabilities (across all Red Hat products and services). Only 80
were accurate. Corrections were submitted to NVD and they fixed the
incorrect CVSS scores on the remaining 98 vulnerabilities. 
So, before the corrections, there were 65 issues rated "High" out
of 178. After the corrections there are actually only 17 rated
"High". Fortunately the number of corrections needed each month
seems to be decreasing, but we'll continue to send in corrections
every month. Even with the corrections, the
severity rating for a given vulnerability may well vary for the
version each vendor ships; so you need to be careful if you are basing
your risk assesments soley on the accuracy of third-party severity ratings.
Created: 06 Nov 2007
Tagged as: cvss, metrics, nvd, red hat
0 comments
(new comments disabled)
|
|
