Re: Vuln scoring system anyone?

[Brian <bmc () snort org>]

On Tue, Mar 01, 2005 at 03:40:11PM -0500, security curmudgeon wrote:
> What if someone posts to an incident list that they got owned by
> this vuln, but the vendor hasn't ack'd it?

I wouldn't trust randoms on an incident list to know what
vulnerability caused the incident they are investigating.

If you see an email to bugtraq saying:
    "I found a vuln in SSH."

And someone else sends an email to incidents:
    "I only run SSH and got owned via SSH."

Then you've got a new confirmed vulnerability?  Not hardly.

Brian
_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
https://lists.immunitysec.com/mailman/listinfo/dailydave