RE: [WEB SECURITY] What is the status of AVDL

["Kurt R. Roemer" <kroemer () netcontinuum com>]

Dinis-

AVDL v1.0 was adopted as an OASIS standard and has been implemented in
several products.  The products I am aware of are SPI Dynamics WebInspect,
Nikto, and the NetContinuum WAF.  

In addition to http://www.avdl.org, information on AVDL can be found at:
http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=avdl

The public database for AVDL never materialized, but, as you mentioned,
would be very beneficial in the adoption and usage of this standard.

The AVDL committee was disbanded last year due to lack of participation in
future standards efforts and was officially closed by OASIS in January 2006.
There was an effort underway to develop AVDL v2.0, but we were unable to
obtain the required participation from 3 vendors.  I was the last Chair of
the OASIS AVDL committee.

If there's interest (and the required vendor commitment) in starting this
back up, please contact me.


-Kurt

Kurt R. Roemer
VP & Chief Technology Officer
NetContinuum, Inc.
847-420-7846 Mobile
kroemer () netcontinuum com
http://www.netcontinuum.com

-----Original Message-----
From: Dinis Cruz [mailto:dinis () ddplus net] 
Sent: Tuesday, May 09, 2006 5:16 PM
To: webappsec () securityfocus com; websecurity () webappsec org
Subject: [WEB SECURITY] What is the status of AVDL 

Ok, so I can see from www.advl.org and Oasis that the AVDL standard was
published in 2004.

My question are

    1) What is the status of this standard?.
    2) Who has adopted it on current versions of their product?
    3) Is there a public database of AVDL?
    4) How are the different AVDL users synchronizing the:

             Title,
             Summary
             Classification name
             Classification score (i..e the Risk rating)


A public database (of AVDL items) looks like a very important piece of
the puzzle and it would be very useful it does exist somewhere.

Dinis Cruz
Owasp .Net Project
www.owasp.net








- Sponsored Advertisement --------------------------------------------------
The Software Security Summit is the only event that addresses security
issues at the application development level. Join us Jun 5-7, Baltimore, MD.
http://www.s-3con.com
----------------------------------------------------------------------------
The Web Security Mailing List
http://www.webappsec.org/lists/websecurity/

The Web Security Mailing List Archives
http://www.webappsec.org/lists/websecurity/archive/


-------------------------------------------------------------------------
Sponsored by: Watchfire

Methodologies & Tools for Web Application Security Assessment
With the rapid rise in the number and types of security threats, web 
application security assessments should be considered a crucial phase in 
the development of any web application. What methodology should be 
followed? What tools can accelerate the assessment process? 
Download this whitepaper today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=701300000007t9h
--------------------------------------------------------------------------