Tag Archives: CNA

Microsoft is beginning to add CVEs to address security flaws in its cloud services

Leave a reply

Microsoft is beginning to add CVEs to address security flaws in its cloud services

Microsoft is beginning to add CVEs to address security flaws in its cloud services. It’s not as straightforward. Assume a cloud CRM has a vulnerability. The vendor instantly corrected it for everyone, and clients didn’t need to take any action. What good is it to issue a CVE for this? 🤔

But Microsoft believes it’s required for greater transparency, and the new rules require CNAs (CVE Numbering Authorities) to add vulnerabilities that could cause significant harm, regardless of whether customers have to take action to fix the vulnerabilities or not. 🤷‍♂️

Microsoft promises to mark such vulnerabilities, such as CVE-2024-35260 “CVE requires no customer action to resolve”. There will be a special tag in CVEorg as well.

Whether or not it is necessary to register cloud service vulnerabilities as CVE is a controversial issue. But it is a fact that, due to this practice, the number of identifiers in CVEorg/NVD will grow much faster. 🤷‍♂️

На русском

Martian Vulnerability Chronicles

Leave a reply

Martian Vulnerability Chronicles. Well, there should have been an optimistic post about my vulnerability analysis & classification pet-project. Something like “blah-blah-blah the situation is pretty bad, tons of vulnerabilities and it’s not clear which of them can be used by attackers. BUT there is a way how to make it better using trivial automation“. And so on. It seems that it won’t be any time soon. ¯\_(ツ)_/¯

I’ve spent several weekends on making some code that takes vulnerability description and other related formalized data to “separate the wheat from the chaff”. And what I get doesn’t look like some universal solution at all.

Pretty frustrating, but still an interesting experience and great protection from being charmed by trendy and shiny “predictive prioritization”.

Martian Vulnerability Chronicles

Literally, when you start analyzing this vulnerability-related stuff every your assumption becomes wrong:

  • that vulnerability description is good enough to get an idea how the vulnerability can be exploited (let’s discuss it in this post);
  • that CVSS characterizes the vulnerability somehow;
  • that the links to related objects (read: exploits) can be actually used for prioritization.

Actually, there is no reliable data that can be analyzed, trash is everywhere and everybody lies 😉

Let’s start from the vulnerability description. Great example is the last week critical Linux kernel vulnerability CVE-2019-8912.

Continue reading →