[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <b206e24d-0025-33a3-deb8-b0d9c7641d19@oracle.com>
Date: Fri, 14 Jul 2017 07:58:37 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com, Steven Miano <mianosm@...il.com>
Subject: Re: Estimate for the total number of exploitable bugs
in large linux distro?
On 07/14/17 02:45 AM, Steven Miano wrote:
> Something like this?
>
> https://www.cvedetails.com/vendor/51/Ubuntu.html
> https://www.cvedetails.com/vendor/7838/Red-Hat.html
> https://www.cvedetails.com/vendor/26/Microsoft.html
Those are known vulnerabilities, with varying degrees of exploitability,
and varying exploit conditions and sometimes differing views on where to
draw the line on what is one issue or multiple issues.
Some of them can be remotely exploited, some require a local user to take
action. Some give access to those who had none, some give higher privs to
those who had some, and some don't change your access levels at all.
Of course, they don't count all the ones that haven't been publicly
disclosed - either because they are unknown or only known to certain people.
And when you start comparing numbers with Linux distros things get even
messier - if you include the count of every issue in every package in
their package repositories then you are including a far larger set of
software than if you just count what's in others OS - but that doesn't
mean they are more or less secure, just that they have more or less
software available for easy installation.
For a far more complete answer of why vulnerability counting is messy,
hard, and just plain sucks, you can turn to the experts:
https://media.blackhat.com/us-13/US-13-Martin-Buying-Into-The-Bias-Why-Vulnerability-Statistics-Suck-WP.pdf
https://media.blackhat.com/us-13/US-13-Martin-Buying-Into-The-Bias-Why-Vulnerability-Statistics-Suck-Slides.pdf
--
-Alan Coopersmith- alan.coopersmith@...cle.com
Oracle Solaris Engineering - https://blogs.oracle.com/alanc
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
