CSIRT-IE Reports on Common Vulnerabilities and Exposures (CVEs)

Objective

CSIRT-IE primary focus, in regard to the following reports, is to identify vulnerable servers and services in the State that may be exploited by publicly disclosed Common Vulnerabilities and Exposures (CVEs), which have a severity rating of 'critical'.  CSIRT-IE seek to inform responsible network operators and constituents, based upon the IP address of the affected server or service, by email and to provide advice and recommendations on how to reduce the threat posed by the CVE to the vulnerable servers or services.

Common Vulnerabilities and Exposures (CVEs)

The mission of the CVE Program is to identify, define, catalogue and publicly disclosed cybersecurity vulnerabilities.  

System used for reporting Common Vulnerabilities and Exposures (CVEs)

No. System Description
1. Common Vulnerabilities and Exposures (CVEs). CVEs identify, define, catalogue and publicly disclosed known information-security vulnerabilities and exposures.

A vulnerability is a weakness which can be exploited to gain unauthorised access to a system or a network, execute code, install malware, and access internal systems to steal, destroy, or modify sensitive data.   If undetected, it could allow a threat actor to pose as a super-user or system administrator with full access privileges.

An exposure is a mistake that gives an attacker access to a system or network.   An exposure can allow an attacker to access personally identifiable information (PIL) and exfiltrate it.  Some of the largest breaches were the result of accidental exposure rather than sophisticated cyber attacks.

The CVE Program emerged from an initiative first launched in 1999 by the independent not-for-profit MITRE Corporation, called the CVE List.

The CVE List provided a method for publicly sharing information on cybersecurity vulnerabilities and exposures, which was adopted by the cybersecurity community.

Sortly afterwards, major operating system vendors and other oganisations from around the world began to include CVE identifiers (IDs) in their alerts.

CVEs are assigned a number known as a CVE identifier (ID) by the CVE Numbering Authorities (CNAs).  CNAs are software vendors, open source projects,  coordination centers,  bug bounty service providers, hosted services,  and research groups authorised by the CVE Program to assign CVE IDs to vulnerabilities and publish CVE Records within their own specific scopes of coverage.

A CVE identifier consist of a [Year] and a [Number].  The Year represents the year in which the vulnerability was reported.  The Number is a sequential number assigned by the CNA.

Details of CVEs are often withheld until the corresponding vendor can issue a patch or fix, ensuring that organisations can protect themselves once the information is made public.  Sharing of information in relation to CVEs can help to mitigate the publicly disclosed vulnerabilities and exposures in a fast and efficient manner and ensure that all organisations are protected.

CVE and the CVE logo are registered trademarks of the MITRE Corporation.   CVE is sponsored by the United States (U.S.) Department of Homeland Security (DHS),  Cybersecurity and Infrastructure Security Agency (CISA). CISA funds the Homeland Security Systems Engineering and Development Institute (HSSEDI), a DHS Federally Funded Research and Development Center (FFRDC) operated by the MITRE Corporation, to operate the CVE Program in cooperation with industry, government, and academic stateholders under a public/private partnership.

The Common Vulnerability Scoring System (CVSS)

The Common Vulnerability Scoring System (CVSS) provides the means to capture the principal characteristics of a vulnerability and produce a numerical score to reflect its severity.

System used for assessing the severity of Common Vulnerabilities and Exposures.

No. System Description
1. The Common Vulnerability Scoring System (CVSS) CVSS is a free and open industry standard for assessing the severity of computer system security vulnerabilities.  It provides a numerical (0-10) representation of the severity of an information security vulnerability.

CVSS v3.0 Ratings

No. Base Score Range Severity
1. 0.0 None
2. 0.1 - 3.9 Low
3. 4.0 - 6.9 Medium
4. 7.0 - 8.9 High
5. 9.0 - 10.0 Critical

Source of Information

The Shadowserver Foundation is a Non-Governmental Organisation and one of the world's leading resources for internet security reporting and malicious activity investigation.  The Shadowserver Foundation works with national governments,   network providers, enterprises, financial and academic institutions, law enforcement agencies, and others, to reveal security vulnerabilities, expose malicious activity and help remediate victims.  The Shadowserver Foundation performs a scan of the entire IPv4 internet every day for Internet accessible servers & services and reports the security vulnerabilities found.   It has also participated in the SISSDEN EU Horizon 2020 project using SISSDEN'S Network of Honeypot Sensors to log unsolicited attack traffic which was directed at them.  Information on Shadowserver Reports and the data contain therein can be found atShadowserver Reports

Secure Information Sharing Sensor Delivery Event Network

The Secure Information Sharing Sensor Delivery Event Network(SISSDEN) seeks to improve the cyber security posture of EU organisations and citizens through the development of increased situational awareness and the effective sharing of actionable information.  The SISSDEN project has received funding from the European Union's Horizon 2020 research and innovation programme.

CVE Reports

Additional Information

CVE Beta website