[
Date Prev
][
Date Next
][
Thread Prev
][
Thread Next
][
Date Index
][
Thread Index
]
RE: Should be a CVE?
The issue is that some firmware versions thought to correct the
original CVE - i.e. ones that end with a 4-digit sequence beginning
with 3, per
https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr:
"Firmware versions that resolve the issue have a four digit build
number that starts with a "3" (X.X.XX.3XXX)" - are actually the source
of the problem in the newer CVE. So you think you're out of the woods,
but a local admin can still "upgrade" to a vulnerable version.
It may warrant a separate CVE since this is a separate thing you would
need to do discovery for and remediate even if you had followed the
prior recommendations in SA-00075.
-----Original Message-----
From: owner-cve-editorial-board-list@lists.mitre.org
[mailto:owner-cve-editorial-board-list@lists.mitre.org] On Behalf Of
Beverly Finch
Sent: Tuesday, September 12, 2017 3:37 PM
To: Waltermire, David A. (Fed) <david.waltermire@nist.gov>;
cve-editorial-board-list@lists.mitre.org
Subject: RE: Should be a CVE?
I agree.
Regards,
Beverly M Finch, PMP
PSIRT Program Manager
Product Security Office
7001 Development Drive
Office 3N-C1
Morrisville, NC 27560
+1 919 294 5873
beverlyfinch@lenovo.com
Lenovo.com
Twitter | Facebook | Instagram | Blogs | Forums
-----Original Message-----
From: owner-cve-editorial-board-list@lists.mitre.org
[mailto:owner-cve-editorial-board-list@lists.mitre.org] On Behalf Of
Waltermire, David A. (Fed)
Sent: Tuesday, September 12, 2017 3:20 PM
To: cve-editorial-board-list@lists.mitre.org
Subject: Should be a CVE?
Looking at the following, it appears that a CVE was issued for the
potential that someone might upgrade software to a vulnerable version,
which has another CVE. I don't think this should qualify as a CVE,
given the actual vulnerability already has one.
https://cve.org/CVERecord?id=CVE-2017-5698
Should this CVE be rejected?
Regards,
Dave
