From: Earl Sammons (ESammons@technicacorp.com)
Date: Wed Sep 17 2003 - 11:35:28 EDT
icat http://icat.nist.gov/icat.cfm (a CVE front-end) does it as described
below. I'm sure there are other/better/worse ways... just an example.
-Earl
A vulnerability is "high severity" if:
1. it allows a remote attacker to violate the security protection of a
system (i.e. gain some sort of user or root account),
2. it allows a local attack that gains complete control of a system,
3. it is important enough to have an associated CERT/CC advisory.
A vulnerability is "medium severity" if:
1. it does not meet the definition of either "high" or "low" severity.
A vulnerability is "low severity" if:
1. the vulnerability does not typically yield valuable information or
control over a system but instead gives the attacker knowledge that may help
the attacker find and exploit other vulnerabilities.
2. we feel that the vulnerability is inconsequential for most
organizations.
-----Original Message-----
From: thomasng@bigfella.is-a-geek.net
To: pen-test@securityfocus.com
Sent: 9/17/03 4:09 AM
Subject: mapping vulnerabilities into high medium low risk
Hi,
Anyone know any open source methodology about categorizing
vulnerabilities? When doing a Pent Test, I need to categorize a
particular
vulnerability into high medium or low risk. These vulnerabilities may be
a
web application vulnerability or may be a new system vuln that has yet
to
be discovered. So is there any open source methodology that give you a
guide to how to categorize the vuln?
Rgds
Thomas
------------------------------------------------------------------------
--- FREE Trial! New for security consultants and in-house pros: FOUNDSTONE PROFESSIONAL and PROFESSIONAL TL software. Fast, reliable vulnerability assessment technology powered by the award-winning FoundScan engine. Try it free for 21 days at: http://www.securityfocus.com/sponsor/Foundstone_pen-test_030825 ------------------------------------------------------------------------ ---- --------------------------------------------------------------------------- FREE Trial! New for security consultants and in-house pros: FOUNDSTONE PROFESSIONAL and PROFESSIONAL TL software. Fast, reliable vulnerability assessment technology powered by the award-winning FoundScan engine. Try it free for 21 days at: http://www.securityfocus.com/sponsor/Foundstone_pen-test_030825 ----------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:53:40 EDT