Head First CVE Ken Lee @echain + Who is Ken? * Former Product - - PowerPoint PPT Presentation

▶
head first cve
SMART_READER_LITE
LIVE PREVIEW

Head First CVE Ken Lee @echain + Who is Ken? * Former Product - - PowerPoint PPT Presentation

Aug 02, 2023 37 likes •911 views

A Brain-Friendly Guide Head First CVE Ken Lee @echain + Who is Ken? * Former Product Developer * Chief Security Officer (WIP) * Head of Synology SIRT https://www.synology.com/security + 2013 T he P hantom M enace * Started working in 2013/01 * No

slide-1
SLIDE 1

Ken Lee @echain A Brain-Friendly Guide

Head First CVE

slide-2
SLIDE 2

+ Who is Ken?

* Former Product Developer * Chief Security Officer (WIP) * Head of Synology SIRT

slide-3
SLIDE 3

https://www.synology.com/security

slide-4
SLIDE 4

+ 2013 The Phantom Menace

* Started working in 2013/01 * No developer to respond to vulnerabilities * Lacked a sense of cybersecurity * High-profile CVEs were notified by customers

slide-5
SLIDE 5

+ 2014 Revenge of the Sith

* Severely affected by you-know-who * Built a working group for cybersecurity * Built private Bounty Program * Deployed security mitigations to DSM 5

slide-6
SLIDE 6

+ 2016 The Empire Strikes Back

* Built Vulnerability Response Program * Built invitation-only Bounty Program * Reported critical flaws of Photo Station * Disclosed vulnerabilities w/o confirmation

slide-7
SLIDE 7

+ 2017 Return of the Jedi

* Authorized as the CNA * Built Incident Response Program * Announced Security Bug Bounty Program * Built Product Security Assurance Program

slide-8
SLIDE 8

+ Agenda

* 00 | Common Vulnerabilities and Exposures * 01 | CVE Numbering Authority * 10 | Phrasing and Counting Rules * 11 | Tool for dummies

slide-9
SLIDE 9

https://cve.mitre.org/news/archives/2019/news.html

slide-10
SLIDE 10
slide-11
SLIDE 11
slide-12
SLIDE 12
slide-13
SLIDE 13
slide-14
SLIDE 14
slide-15
SLIDE 15
slide-16
SLIDE 16

https://cve.mitre.org/cve/cna/rules.html

slide-17
SLIDE 17

https://cve.mitre.org/cve/cna/rules.html

slide-18
SLIDE 18

[CWE] in [CPE] allows [ATTACKER] to have IMPACT via [CAPEC].

slide-19
SLIDE 19

+ MITRE’s Template

* [VULNTYPE] in [COMPONENT] in [VENDOR] * [PRODUCT] [VERSION] allows [ATTACKER] * to [IMPACT] via [VECTOR]. * [COMPONENT] in [VENDOR] [PRODUCT] * [VERSION] [ROOT CAUSE], which allows * [ATTACKER] to [IMPACT] via [VECTOR].

https://cveproject.github.io/docs/content/key-details-phrasing.pdf

slide-20
SLIDE 20
slide-21
SLIDE 21
slide-22
SLIDE 22
slide-23
SLIDE 23
slide-24
SLIDE 24
slide-25
SLIDE 25
slide-26
SLIDE 26
slide-27
SLIDE 27
slide-28
SLIDE 28

+ Version

* List vulnerable version * - 1.2.3 * - 1.2.3, 2.3.1, and 3.1.2

slide-29
SLIDE 29

+ Version

* List vulnerable version * Earlier versions are affected * - 1.2.3 and earlier * - 1.2.3, 2.3.1, 3.1.2, and earlier

slide-30
SLIDE 30

+ Version

* List vulnerable version * Earlier versions are affected * Fixed or updated version * - before 1.2.3 * - before 1.2.3, 2.x before 2.3.1, and 3.x before 3.1.2

slide-31
SLIDE 31

+ Version

* List vulnerable version * Earlier versions are affected * Fixed or updated version * Vulnerable range * - 1.2.1 through 1.2.3 * - 1.2.1 through 1.2.3 and 2.0.1 through 2.3.1

slide-32
SLIDE 32

https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

slide-33
SLIDE 33

+ Attacker

* Remote attackers * Remote authenticated users * Local users * Physically proximate attackers * Man-in-the-middle attackers

* - AV:N * - AC:L * - PR:N

slide-34
SLIDE 34

+ Attacker

* Remote attackers * Remote authenticated users * Local users * Physically proximate attackers * Man-in-the-middle attackers

* - AV:N * - AC:L * - PR:L

slide-35
SLIDE 35

+ Attacker

* Remote attackers * Remote authenticated users * Local users * Physically proximate attackers * Man-in-the-middle attackers

* - AV:L * - AC:L * - PR:L

slide-36
SLIDE 36

+ Attacker

* Remote attackers * Remote authenticated users * Local users * Physically proximate attackers * Man-in-the-middle attackers

* - AV:P * - AC:L * - PR:N

slide-37
SLIDE 37

+ Attacker

* Remote attackers * Remote authenticated users * Local users * Physically proximate attackers * Man-in-the-middle attackers

* - AV:N * - AC:H * - PR:N

slide-38
SLIDE 38

+ Attacker

* Remote [TYPE] servers * Guest OS users * Guest OS administrators * Context-dependent attackers * [EXTENT] user-assisted [ATTACKER] * Attackers

slide-39
SLIDE 39
slide-40
SLIDE 40
slide-41
SLIDE 41
slide-42
SLIDE 42
slide-43
SLIDE 43
slide-44
SLIDE 44
slide-45
SLIDE 45
slide-46
SLIDE 46

https://devco.re/blog/2019/11/11/HiNet-GPON-Modem-RCE/

slide-47
SLIDE 47
slide-48
SLIDE 48
slide-49
SLIDE 49
slide-50
SLIDE 50
slide-51
SLIDE 51
slide-52
SLIDE 52

+ CVE-2019-13411 (TWCERT/CC)

An “invalid command” handler issue was discovered in HiNet GPON firmware < I040GWR190731. It allows an attacker to execute arbitrary command through port 3097. CVSS 3.0 Base score 10.0. CVSS vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

slide-53
SLIDE 53

[VULNTYPE] in [COMPONENT] in [VENDOR] [PRODUCT] [VERSION] allows [ATTACKER] to [IMPACT] via [VECTOR].

slide-54
SLIDE 54

+ CVE-2019-13411 (Revised)

OS command injection vulnerability in omcimain in HiNet GPON firmware before I040GWR190731 allows remote attackers to execute arbitrary command via port 3097.

slide-55
SLIDE 55

+ Cross-site Scripting (1-1)

Cross-site scripting (XSS) vulnerability in

[COMPONENT] in [VENDOR] [PRODUCT] [VERSION]

allows remote attackers to inject arbitrary web script

  • r HTML via the [PARAM] parameter.
slide-56
SLIDE 56

+ Cross-site Scripting (1-N)

Multiple cross-site scripting (XSS) vulnerabilities in

[VENDOR] [PRODUCT] [VERSION] allow remote attackers

to inject arbitrary web script or HTML via the [PARAM] parameter to (1) [COMPONENT1], (2) [COMPONENT2], ..., or (n) [COMPONENTn].

slide-57
SLIDE 57

+ Cross-site Scripting (N-1)

Multiple cross-site scripting (XSS) vulnerabilities in

[COMPONENT] in [VENDOR] [PRODUCT] [VERSION] allow

remote attackers to inject arbitrary web script or HTML via the [PARAM1], (2) [PARAM2], ..., or (n) [PARAMn] parameter.

slide-58
SLIDE 58

+ Cross-site Scripting (N-N)

Multiple cross-site scripting (XSS) vulnerabilities in the (1) [PARAM1] or (2) [PARAM2] parameter to [COMPONENT1]; the (3) [PARAM3] parameter to [COMPONENT2]; ...;

  • r (n) [PARAMn] parameter to [COMPONENTm].

[VENDOR] [PRODUCT] [VERSION] allow remote attackers

to inject arbitrary web script or HTML via

slide-59
SLIDE 59

+ SQL Injection (1-1)

SQL injection vulnerability in [COMPONENT] in

[VENDOR] [PRODUCT] [VERSION] allows [ATTACKER] to execute arbitrary SQL commands

via the [PARAM] parameter.

slide-60
SLIDE 60

+ SQL Injection (1-N)

Multiple SQL injection vulnerabilities in

[VENDOR] [PRODUCT] [VERSION] allow [ATTACKER]

to execute arbitrary SQL commands via the [PARAM] parameter to (1) [COMPONENT1], (2) [COMPONENT2], ..., or (n) [COMPONENTn].

slide-61
SLIDE 61

+ SQL Injection (N-1)

Multiple SQL injection vulnerabilities in

[COMPONENT] in [VENDOR] [PRODUCT] [VERSION] allow [ATTACKER] to execute arbitrary SQL commands via

the (1) [PARAM1], (2) [PARAM2], ..., or (n) [PARAMn] parameter.

slide-62
SLIDE 62

+ SQL Injection (N-N)

Multiple SQL injection vulnerabilities in to execute arbitrary SQL commands via the (1) [PARAM1] or (2) [PARAM2] parameter to [COMPONENT1]; (n) [PARAMn] parameter to [COMPONENTm].

[VENDOR] [PRODUCT] [VERSION] allow [ATTACKER]

the (3) [PARAM3] parameter to [COMPONENT2]; ...;

slide-63
SLIDE 63

+ Counting Decisions

* CNT1 | Independently Fixable * CNT2 | Vulnerability * - CNT2.1 | Vendor Acknowledgment * - CNT2.2A | Claim-Based * - CNT2.2B | Security Model-Based

slide-64
SLIDE 64

+ Counting Decisions

* CNT3 * - Shared Codebase * - Libraries, Protocols, or Standards

slide-65
SLIDE 65

+ Inclusion Decisions

* INC1 | In Scope of Authority * INC2 | Intended to be Public * INC3 | Installable / Customer-Controlled Software * INC4 | Generally Available and Licensed Product * INC5 | Duplicate

slide-66
SLIDE 66

+ Edge Cases

* MD5 / SHA-1 * Default Credentials * Cloudbleed * End-of-life products

slide-67
SLIDE 67

+ Edge Cases

* MD5 / SHA-1 * Default Credentials * Cloudbleed * End-of-life products

slide-68
SLIDE 68

+ Edge Cases

* Default Credentials * Cloudbleed * End-of-life products * MD5 / SHA-1

slide-69
SLIDE 69

+ Edge Cases

* Default Credentials * Cloudbleed * End-of-life products * MD5 / SHA-1

slide-70
SLIDE 70
slide-71
SLIDE 71
slide-72
SLIDE 72
slide-73
SLIDE 73
slide-74
SLIDE 74

+ Update CVE Entries

* Reject * - Not a vulnerability (fails CNT2) * - Not to make the vulnerability public (fails INC2) * - Not customer controlled (fails INC3) * - Not generally available (fails INC4)

slide-75
SLIDE 75

+ Update CVE Entries

* Reject * Merge * - Not independently fixable (fails CNT1) * - Result of shared codebase, library, etc. (fails CNT3) * - Duplicate assignment (fails INC5)

slide-76
SLIDE 76

+ Update CVE Entries

* Reject * Merge * Split * - Contains interpedently fixable bugs (passes CNT1) * - Not share a codebase (fails CNT3) * - To be implementation specific (fails CNT3)

slide-77
SLIDE 77

+ Update CVE Entries

* Reject * Merge * Split * Dispute * - Validity of the vulnerability is questioned

slide-78
SLIDE 78

+ Update CVE Entries

* Reject * Merge * Split * Dispute * Partial Duplicate

slide-79
SLIDE 79
slide-80
SLIDE 80
slide-81
SLIDE 81
slide-82
SLIDE 82
slide-83
SLIDE 83
slide-84
SLIDE 84

+ Catch 'Em All

* How CVE and CNA works

slide-85
SLIDE 85

+ Catch 'Em All

* How CVE and CNA works * Why Synology want to be a CNA * - Expertise around products within our scope * - Control the disclosure policy and procedure

slide-86
SLIDE 86

+ Catch 'Em All

* How CVE and CNA works * Why Synology want to be a CNA * How to write CVE descriptions * - CWE / CPE * - Version * - Attacker

slide-87
SLIDE 87

+ Catch 'Em All

* How CVE and CNA works * Why Synology want to be a CNA * How to write CVE descriptions * CVE counting rules * - Counting decisions * - Inclusion decisions