Gov't.-published List of Computer Security Holes

Follow Slashdot stories on Twitter

Gov't.-published List of Computer Security Holes 25

Posted by timothy on Thursday August 11, 2005 @03:16PM from the benefitting-the-commonwealth dept.

Arngautr writes "ScienceDaily.com reports that The U.S. government has created a 'comprehensive database of computer vulnerabilities,' The National Vulnerability Database. Updated daily, it currently includes almost 12,000 vulnerabilities. Should be a boon to IT professionals and script kiddies alike."

This discussion has been archived. No new comments can be posted.

Gov't.-published List of Computer Security Holes

Load All Comments

Search 25 Comments Log In/Create an Account

Comments Filter:

This might actually be useful (Score:4, Interesting)

by Anonymous Coward writes: on Thursday August 11, 2005 @03:17PM (#13297312)

The first thing that caught me eye on there was "Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges."

And guess which version of Tar is GNU's latest.

Anyway, I can't believe I'm saying this, but thanks US Gov!

Share
twitter facebook
- Re:This might actually be useful (Score:1)
  
  by Captain BooBoo ( 614996 ) writes:
  
  Sure its useful...everything the government puts out is "useful" in some way or another. Personally I like the idea. The question is when will the site be hacked.
  - SUMMARY: (Score:2)
    
    by Jeremiah Cornelius ( 137 ) writes:
    
    Hey! It's CVE with an RSS feed!
- Re:This might actually be useful (Score:2)
  
  by nocomment ( 239368 ) writes:
  
  Ya the only way it could be any better is if they said which vulns actually had known exploits with links to the source. For, you know, testing purposes.
- Re:This might actually be useful (Score:3, Interesting)
  
  by MobyDisk ( 75490 ) writes:
  
  Granted, it would be a nice feature, but why would you run tar as root to install something into a globally readable folder without full knowing what it is extracting? And why is it tar's job to tell you that this is a bad idea?
  
  which may allow local users or remote attackers to gain privileges."
  
  A better way to say that is that you are giving local users or remote attackers priveledges. This is very different from a buffer overflow.
Which is it? (Score:1)

by base3 ( 539820 ) writes:

From the posting: Should be a boon to IT professionals and script kiddies alike.
Are we for full disclosure or security through obscurity? Let's decide which and be consistent, please.
- Re:Which is it? (Score:2)
  
  by CDarklock ( 869868 ) writes:
  
  But we ARE consistent. We consistently make no value judgements on which side of the security fence is the "right" side.
  - Re:Which is it? (Score:2)
    
    by superpulpsicle ( 533373 ) writes:
    
    Unfortunately the judgement is based on $$$.
- Re:Next step... (Score:1, Interesting)
  
  by TheCreeep ( 794716 ) writes:
  
  I ran a couple of searches search:
  "windows"
  There are 767 matching records.
  "linux"
  There are 1055 matching records.
  My guess is that they missed some bugs :/
  - Re:Next step... (Score:3, Insightful)
    
    by Ingolfke ( 515826 ) writes:
    
    My guess is that they missed some bugs :/
    
    The list is no doubt not absolutely complete... but you could easily attribute the difference in the # of vulnerabilities between Windows and Linux to the the fact that Linux is Open Source, and therefore more people are participating in the debugging process. Or it could be that Windows really does have fewer vulnerabilities than Windows. Of course that doesn't mean that the vulnerabilities that it does have are less impactful than those on Linux.
    - Re:Next step... (Score:1)
      
      by Chaotic Spyder ( 896445 ) writes:
      
      OOPS..
      
      Or it could be that Windows really does have fewer vulnerabilities than Windows
      
      Maybe "Or it could be that Linux really does have fewer vulnerabilities than Windows"
  - Re:Next step... (Score:2)
    
    by Muad'Dave ( 255648 ) writes:
    
    "microsoft" returns 1127 hits.
    - Re:Next step... (Score:2)
      
      by Muad'Dave ( 255648 ) writes:
      
      "XP" returns 914.
  - Re:Next step... (Score:3, Informative)
    
    by It doesn't come easy ( 695416 ) * writes:
    
    It depends on the search criteria. The initial page doesn't tell you what it's doing. If you use the "Advanced Search" plage, and select for the Vendor, you get:
    Linux = 942
    Microsoft = 1097
    
    I'm not sure who the Linux vendor is. :)
    
    Then, if you search by remotely executable and high vulnerability, you get:
    Linux = 232
    Microsoft = 376
    
    If you add "allows admin access" you get:
    Linux = 110
    Microsoft = 62
    
    So, expect to see all sorts of statistics to prove one way or the other that both Windows and Linux a
    - Re:Next step... (Score:3, Interesting)
      
      by NemoX ( 630771 ) writes:
      
      But, this compares a platform (consisting of many companies with many producst) to one company (with many products).
      
      Try the advanced search and compare O/S to O/S...which yields:
      
      Windows XP: 139
      SuSE Linux 9.3: 8
      - Re:Next step... (Score:2)
        
        by It doesn't come easy ( 695416 ) * writes:
        
        True. No doubt everyone will create their own way to slice and dice this search engine. You know what the say about statistics...
Unknown bug (Score:4, Funny)

by TheCreeep ( 794716 ) writes: on Thursday August 11, 2005 @03:27PM (#13297390)

CAN-2005-1767 Summary: Unknown vulnerability in the Linux kernel 2.6.x and 2.4.x allows local users to cause a denial of service (stack fault exception) via unknown attack vectors. Published: 8/5/2005 Severity: Medium

"I don't know where, I don't know how, but there's a bug in your kernel!"

Share
twitter facebook
What, no RSS Feed? (Score:1, Insightful)

by Anonymous Coward writes:

My compliments to the U.S. Government for having the database, and having it be populated with current information.

However, the whole thing is a bit 2002 in approach. Please add an RSS feed so that I can scan what's changed since I last looked at it.

Yours,
Sysadmin
- Re:What, no RSS Feed? (Score:2)
  
  by Arctic Dragon ( 647151 ) writes:
  
  You mean this RSS feed [nist.gov]?
Full disclosure ? (Score:1)

by darthgnu ( 866920 ) writes:

I'm sure the NSA still keeps the most juicy security bugs for itself for "defending" against "cyberterrorism". I am willing to bet they would be willing to use these unvoluntary backdoors to bring down criminal organizations. Hopefully, all this information is in the hands of "good". </conspiracy>
- Re:Full disclosure ? (Score:2)
  
  by 3waygeek ( 58990 ) writes:
  
  Well, they are about 200 years ahead [milk.com] of the rest of the world in mathematical theory, so you just might be onto something.

There may be more comments in this discussion. Without JavaScript enabled, you might want to turn on Classic Discussion System in your preferences instead.

Gov't.-published List of Computer Security Holes 25

Gov't.-published List of Computer Security Holes More Login

Gov't.-published List of Computer Security Holes

This might actually be useful (Score:4, Interesting)

Re:This might actually be useful (Score:1)

SUMMARY: (Score:2)

Re:This might actually be useful (Score:2)

Re:This might actually be useful (Score:3, Interesting)

Which is it? (Score:1)

Re:Which is it? (Score:2)

Re:Which is it? (Score:2)

Re:Next step... (Score:1, Interesting)

Re:Next step... (Score:3, Insightful)

Re:Next step... (Score:1)

Re:Next step... (Score:2)

Re:Next step... (Score:2)

Re:Next step... (Score:3, Informative)

Re:Next step... (Score:3, Interesting)

Re:Next step... (Score:2)

Unknown bug (Score:4, Funny)

What, no RSS Feed? (Score:1, Insightful)

Re:What, no RSS Feed? (Score:2)

Full disclosure ? (Score:1)

Re:Full disclosure ? (Score:2)

Related Links Top of the: day, week, month.

Slashdot Top Deals

Slashdot