Bugtraq mailing list archives
Re: "Local" and "Remote" considered insufficient
From: Florian Weimer <fw () deneb enyo de>
Date: Thu, 23 Oct 2003 19:59:05 +0200
Ejovi Nuwere wrote:
To summarize a vurnerability in one line is always difficult, more so when you are writting in a language other then your native tongue. Your ideas might help eleviate some of those troubles but not the core, in addition to language issues, most security researchers are simply poor writers. All of the complexities you detailed are very real, that is why there needs to be a simplified terminology.
In this case, I'd assume it's the responsiblity of the vendors to hire people who improve the quality of security advisories.
While Local and Remote alone are clearly not enough, Local, Remote, Remote Level 1, Remote Beta and Remote Delta will not help either.
You need not restrict yourself to these signal words. While it's common to write just three lines about a vulnerability, nobody (well, except your legal department) forces you to be so terse.
The idea of Local, Remote, and Remote Authenticated sounds nice and I would love to see more researchers adhere to this phrasing or something similar to the risk catagories vurnerability scanners use. Low, Medium and High, three classifications, then let the end user sort them out.
Risk assessment is something that has to be done locally because it is greatly affected by local implementation decisions and the threats you face.
Current thread:
- "Local" and "Remote" considered insufficient Steven M. Christey (Oct 22)
- Re: "Local" and "Remote" considered insufficient Ejovi Nuwere (Oct 23)
- Re: "Local" and "Remote" considered insufficient Florian Weimer (Oct 23)
- Re: "Local" and "Remote" considered insufficient Eric Knight (Oct 23)
- Re: "Local" and "Remote" considered insufficient Ejovi Nuwere (Oct 23)