HOME

TheInfoList



OR:

A vulnerability database (VDB) is a platform aimed at collecting, maintaining, and disseminating information about discovered computer security vulnerabilities. The
database In computing, a database is an organized collection of data stored and accessed electronically. Small databases can be stored on a file system, while large databases are hosted on computer clusters or cloud storage. The design of databases sp ...
will customarily describe the identified vulnerability, assess the potential impact on affected systems, and any workarounds or updates to mitigate the issue. A VDB will assign a unique identifier to each vulnerability cataloged such as a number (e.g. 123456) or
alphanumeric Alphanumericals or alphanumeric characters are a combination of alphabetical and numerical characters. More specifically, they are the collection of Latin letters and Arabic digits. An alphanumeric code is an identifier made of alphanumeric c ...
designation (e.g. VDB-2020-12345). Information in the database can be made available via web pages, exports, or
API An application programming interface (API) is a way for two or more computer programs to communicate with each other. It is a type of software interface, offering a service to other pieces of software. A document or standard that describes how ...
. A VDB can provide the information for free, for pay, or a combination thereof.


History

The first vulnerability database was the "Repaired Security Bugs in Multics", published by February 7, 1973 b
Jerome H. Saltzer
He described the list as "''a list of all known ways in which a user may break down or circumvent the protection mechanisms of
Multics Multics ("Multiplexed Information and Computing Service") is an influential early time-sharing operating system based on the concept of a single-level memory.Dennis M. Ritchie, "The Evolution of the Unix Time-sharing System", Communications of ...
''". The list was initially kept somewhat private with the intent of keeping vulnerability details until solutions could be made available. The published list contained two local privilege escalation vulnerabilities and three local denial of service attacks.


Types of vulnerability databases

Major vulnerability databases such as the ISS X-Force database, Symantec / SecurityFocus BID database, and the
Open Source Vulnerability Database The Open Sourced Vulnerability Database (OSVDB) was an independent and open-sourced vulnerability database. The goal of the project was to provide accurate, detailed, current, and unbiased technical information on security vulnerabilities. The p ...
(OSVDB) aggregate a broad range of publicly disclosed vulnerabilities, including Common Vulnerabilities and Exposures (CVE). The primary purpose of CVE, run by
MITRE The mitre (Commonwealth English) (; Greek: μίτρα, "headband" or "turban") or miter (American English; see spelling differences), is a type of headgear now known as the traditional, ceremonial headdress of bishops and certain abbots in ...
, is to attempt to aggregate public vulnerabilities and give them a standardized format unique identifier. Many vulnerability databases develop the received intelligence from CVE and investigate further providing vulnerability risk scores, impact ratings, and the requisite workaround. In the past, CVE was paramount for linking vulnerability databases so critical patches and debugs can be shared to inhibit hackers from accessing sensitive information on private systems. The
National Vulnerability Database The National Vulnerability Database (NVD) is the U.S. government repository of standards-based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, ...
(NVD), run by the
National Institute of Standards and Technology The National Institute of Standards and Technology (NIST) is an agency of the United States Department of Commerce whose mission is to promote American innovation and industrial competitiveness. NIST's activities are organized into physical sci ...
(NIST), is operated separately from the MITRE-run CVE database, but only includes vulnerability information from CVE. NVD serves as an enhancement to that data by providing
Common Vulnerability Scoring System The Common Vulnerability Scoring System (CVSS) is a free and open industry standard for assessing the severity of computer system security vulnerabilities. CVSS attempts to assign severity scores to vulnerabilities, allowing responders to prioriti ...
(CVSS) risk scoring and Common Platform Enumeration (CPE) data. The
Open Source Vulnerability Database The Open Sourced Vulnerability Database (OSVDB) was an independent and open-sourced vulnerability database. The goal of the project was to provide accurate, detailed, current, and unbiased technical information on security vulnerabilities. The p ...
provides an accurate, technical and unbiased index on vulnerability security. The comprehensive database cataloged over 121,000 vulnerabilities. The OSVDB was founded in August 2002 and was launched in March 2004. In its primitive beginning, newly identified vulnerabilities were investigated by site members and explanations were detailed on the website. However, as the necessity for the service thrived, the need for dedicated staff resulted in the inception of the Open Security Foundation (OSF) which was founded as a non-profit organisation in 2005 to provide funding for security projects and primarily the OSVDB. The OSVDB closed in April 2016. The U.S.
National Vulnerability Database The National Vulnerability Database (NVD) is the U.S. government repository of standards-based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, ...
is a comprehensive cyber security vulnerability database formed in 2005 that reports on CVE. The NVD is a primary cyber security referral tool for individuals and industries alike providing informative resources on current vulnerabilities. The NVD holds in excess of 100,000 records. Similar to the OSVDB, the NVD publishes impact ratings and categorises material into an index to provide users with an intelligible search system. Other countries have their own vulnerability databases, such as the Chinese National Vulnerability Database and Russia's Data Security Threats Database. A variety of commercial companies also maintain their own vulnerability databases, offering customers services which deliver new and updated vulnerability data in machine-readable format as well as through web portals. Examples include Symantec's DeepSight portal and vulnerability data feed, Secunia's (purchased by Flexera) vulnerability manager and Accenture's vulnerability intelligence service (formerly ). Vulnerability databases advise organisations to develop, prioritize, and execute patches or other mitigations which attempt to rectify critical vulnerabilities. However, this can often lead to the creation of additional susceptibilities as patches are created hastily to thwart further system exploitations and violations. Depending upon the level of a user or organisation, they warrant appropriate access to a vulnerability database which provides the user with disclosure of known vulnerabilities that may affect them. The justification for limiting access to individuals is to impede hackers from being versed in corporation system vulnerabilities which could potentially be further exploited.


Use of vulnerability databases

Vulnerability databases contain a vast array of identified vulnerabilities. However, few organisations possess the expertise, staff, and time to revise and remedy all potential system susceptibilities hence vulnerability scoring is a method of quantitatively determining the severity of a system violation. A multitude of scoring methods exist across vulnerability databases such as US-CERT and SANS Institute's Critical Vulnerability Analysis Scale but the
Common Vulnerability Scoring System The Common Vulnerability Scoring System (CVSS) is a free and open industry standard for assessing the severity of computer system security vulnerabilities. CVSS attempts to assign severity scores to vulnerabilities, allowing responders to prioriti ...
(CVSS) is the prevailing technique for most vulnerability databases including OSVDB, and NVD. The CVSS is based upon three primary metrics: base, temporal and environmental which each provide a vulnerability rating.


Base

This metric covers the immutable properties of a vulnerability such as the potential impact of the exposure of confidential information, the accessibility of information and the aftermath of the irretrievable deletion of information.


Temporal

The temporal metrics denote the mutable nature of a vulnerability for example the credibility of an exploitability, the current state of a system violation and the development of any workarounds that could be applied.


Environmental

This aspect of the CVSS rates the potential loss to individuals or organisations from a vulnerability. Furthermore, it details the primary target of a vulnerability ranging from personal systems to large organisations and the number of potentially affected individuals. The complication with utilising different scoring systems it that there is no consensus on the severity of a vulnerability thus different organisations may overlook critical system exploitations. The key benefit of a standardised scoring system like CVSS is that published vulnerability scores can be assessed, pursued and remedied rapidly. Organisations and individuals alike can determine the personal impact of a vulnerability on their system. The benefits derived from vulnerability databases to consumers and organisations are exponential as information systems become increasingly embedded, our dependency and reliance on them grows, as does the opportunity for data exploitation.


Common security vulnerabilities listed on vulnerability databases


Initial deployment failure

Although the functionality of a database may appear unblemished, without rigorous testing, the exiguous flaws can allow hackers to infiltrate a system's cyber security. Frequently, databases are published without stringent security controls hence the sensitive material is easily accessible.


SQL injection

Database attacks are the most recurrent form of cyber security breaches recorded on vulnerability databases. SQL and NoSQL injections penetrate traditional information systems and big data platforms respectively and interpolate malicious statements allowing the hackers unregulated system access.


Misconfigured databases

Established databases ordinarily fail to implement crucial patches suggested by vulnerability databases due to an excessive workload and the necessity for exhaustive trialling to ensure the patches update the defective system vulnerability. Database operators concentrate their efforts into major system deficiencies which offers hackers unmitigated system access through neglected patches.


Inadequate auditing

All databases require audit tracks to record when data is amended or accessed. When systems are created without the necessary auditing system, the exploitation of system vulnerabilities are challenging to identify and resolve. Vulnerability databases promulgate the significance of audit tracking as a deterrent of cyber attacks. Data protection is essential to any business as personal and financial information is a key asset and the purloining of sensitive material can discredit the reputation of a firm. The implementation of data protection strategies is imperative to guard confidential information. Some hold the view that is it the initial apathy of software designers that in turn, necessitates the existence of vulnerability databases. If systems were devised with greater diligence, they may be impenetrable from SQL and NoSQL injections making vulnerability databases redundant.


See also

*
Common Vulnerabilities and Exposures The Common Vulnerabilities and Exposures (CVE) system provides a reference-method for publicly known information-security vulnerabilities and exposures. The United States' National Cybersecurity FFRDC, operated by The MITRE Corporation, mainta ...
* Japan Vulnerability Notes *
National Vulnerability Database The National Vulnerability Database (NVD) is the U.S. government repository of standards-based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, ...
*
Open Source Vulnerability Database The Open Sourced Vulnerability Database (OSVDB) was an independent and open-sourced vulnerability database. The goal of the project was to provide accurate, detailed, current, and unbiased technical information on security vulnerabilities. The p ...


Notes


References

{{reflist, 30em Computer security exploits Types of databases *