Help me fill out a list of flaw types

[Josh Bressers]

Hi all,

I'm working to fill out a list of types of security flaws. I'm happy to
include obscure items on the list. I plan to use the list to document these
issues in some meaningful way in the future.

My brain seems to be stuck today, I'm not coming up with as many as I know
I should.

Feel free to lend an old man a hand:
http://etherpad-security.rhcloud.com/p/flaw-types

Thanks.

-- 
Josh Bressers / Red Hat Product Security Team

[kplaxmaster]

Josh,

Is this what you are meaning to do?

http://cwe.mitre.org/

The standard seems robust... implementation is another discussion all
together.

R/
Andrew Harris
Dept of Defense


On Mon, Aug 5, 2013 at 1:13 PM, Josh Bressers <bressers(a)redhat.com&gt; wrote:

>  Hi all,
>
>  I'm working to fill out a list of types of security flaws. I'm happy to
>  include obscure items on the list. I plan to use the list to document these
>  issues in some meaningful way in the future.
>
>  My brain seems to be stuck today, I'm not coming up with as many as I know
>  I should.
>
>  Feel free to lend an old man a hand:
>  http://etherpad-security.rhcloud.com/p/flaw-types
>
>  Thanks.
>
>  --
>  Josh Bressers / Red Hat Product Security Team
>  --
>  security mailing list
>  security(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/security

[Josh Bressers]

----- Original Message -----
>  Josh,
>  
>  Is this what you are meaning to do?
>  
>  http://cwe.mitre.org/
>  
>  The standard seems robust... implementation is another discussion all
>  together.
>   
The standard is probably too robust. CWE is great, but it's too big. I need
a list I can easily read and understand.

Plus it's a nice way for us all to bikeshed I mean discuss some of the
topics ;)

Thanks.

-- 
Josh Bressers / Red Hat Product Security Team

[David]

On 08/05/2013 02:03 PM, Josh Bressers wrote:
>  ----- Original Message -----
> > Josh,
> >
> > Is this what you are meaning to do?
> >
> > http://cwe.mitre.org/
> >
> > The standard seems robust... implementation is another discussion all
> > together.
> >
>  The standard is probably too robust. CWE is great, but it's too big. I need
>  a list I can easily read and understand.
>
>  Plus it's a nice way for us all to bikeshed I mean discuss some of the
>  topics ;)
>
>  Thanks.
>  
Did you have a particular use-case in mind for your list?  Will you be 
accessing this list programmatically or just for human consumption? 
Perhaps a schema/classification skeleton we could start with?  Do you 
want a list of specific exploits/vulnerabilities (so you might start 
with local and remote for example then drill down with stack exploits, 
cross site injections etc) or just a list of the monikers of actual 
exploits like "sasser", or something more like "social engineering", 
"network", "program code"..."input validation", etc?

David

[Josh Bressers]

>  
>  Did you have a particular use-case in mind for your list?  Will you be
>  accessing this list programmatically or just for human consumption?
>  Perhaps a schema/classification skeleton we could start with?  Do you
>  want a list of specific exploits/vulnerabilities (so you might start
>  with local and remote for example then drill down with stack exploits,
>  cross site injections etc) or just a list of the monikers of actual
>  exploits like "sasser", or something more like "social engineering",
>  "network", "program code"..."input validation", etc?
>   
Basically it's just a list for me. I'm putting together a nice list of
possible topics for a variety of reasons. I figured it would be nice to get
input from others, and obvious make such a list public for anyone who
wanted something similar.

It's a pretty open request, so I'd say anything goes. If you have some
ideas, jot them down.

Thanks.

-- 
Josh Bressers / Red Hat Product Security Team

[David]

Ok I've read your existing list.
you might consider a section for system configuration errors (ex. LDAP 
auth being passed in clear to an AD server that doesn't support 
starttls/ssl when not using GSSAPI or having SSH 1 available, etc)

seeding errors for rand yielding predictable results
improper handling of errno values resulting in lock/race/buffer probs

On 08/12/2013 02:20 PM, Josh Bressers wrote:
> > Did you have a particular use-case in mind for your list?  Will
> you be
> > accessing this list programmatically or just for human consumption?
> > Perhaps a schema/classification skeleton we could start with?  Do you
> > want a list of specific exploits/vulnerabilities (so you might start
> > with local and remote for example then drill down with stack exploits,
> > cross site injections etc) or just a list of the monikers of actual
> > exploits like "sasser", or something more like "social
> engineering",
> > "network", "program code"..."input validation", etc?
> >
>  Basically it's just a list for me. I'm putting together a nice list of
>  possible topics for a variety of reasons. I figured it would be nice to get
>  input from others, and obvious make such a list public for anyone who
>  wanted something similar.
>
>  It's a pretty open request, so I'd say anything goes. If you have some
>  ideas, jot them down.
>
>  Thanks.
>