CVE Announce - March 18, 2009 (opt-in newsletter from the CVE Web site)

Welcome to the latest edition of the CVE-Announce e-newsletter.
This email newsletter is designed to bring recent news about CVE,
such as new versions, upcoming conferences, new Web site features,
etc. right to your emailbox. Common Vulnerabilities and Exposures
(CVE) is the standard for information security vulnerability
names. CVE content results from the collaborative efforts of the
CVE Editorial Board, which is comprised of leading representatives
from the information security community. Details on subscribing
(and unsubscribing) to the email newsletter are at the end. Please
feel free to pass this newsletter on to interested colleagues.

Comments: cve@mitre.org

-------------------------------------------------------
CVE-Announce e-newsletter/March 18, 2009
-------------------------------------------------------

Contents:

1. Feature Story
2. Hot Topic
3. Also in this Issue
4. Details/Credits + Subscribing and Unsubscribing

FEATURE STORY:

CVE Compatibility Update

Two additional organizations have recently made delcarations of
CVE Compatbility: (1) Beijing Topsec Co., Ltd. declared that its
Topsec Intrusion Protection System (TopIDP) is CVE-Compatible, and
(2) SoftRun, Inc. declared that its vulnerability assessment and
remediation tool, Inciter Vulnerability Manager, is
CVE-Compatible.

For additional information and to review the complete list of all
products and services participating in the compatibility program,
visit the CVE Adoption Program section.

LINKS:

Beijing Topsec Co., Ltd. - http://www.topsec.com.cn

SoftRun, Inc. - http://www.softrun.com

CVE Adoption Program - http://cve.mitre.org/adoption/index.html

---------------------------------------------------------------
HOT TOPIC:

CVE List Surpasses 35,000 CVE Identifiers

The CVE Web site now contains 35,529 unique information security
issues with publicly known names. CVE, which began in 1999 with
just 321 common names on the CVE List, is considered the
international standard for public software vulnerability names.
Information security professionals and product vendors from around
the world use CVE Identifiers (CVE-IDs) as a standard method for
identifying vulnerabilities, and for cross-linking among products,
services, and other repositories that use the identifiers.

Each of the 35,000+ identifiers on the CVE List includes the
following: CVE Identifier number (i.e., "CVE-1999-0067");
indication of "entry" or "candidate" status; brief description of
the security vulnerability; and pertinent references such as
vulnerability reports and advisories or OVAL-ID. Visit the CVE
List page to download the complete list in various formats or to
look-up an individual identifier. Fix information and enhanced
searching of CVE is available from NVD.

LINKS:

CVE List - http://cve.mitre.org/cve

National Vulnerability Database (NVD) - http://nvd.nist.gov

---------------------------------------------------------------
ALSO IN THIS ISSUE:

* MITRE Hosts "Making Security Measurable" Booth at "InfoSec World
2009"

Read these stories and more news at http://cve.mitre.org/news

---------------------------------------------------------------
Details/Credits + Subscribing and Unsubscribing

Managing Editor: David Mann, Information Security Technical
Center. Writer: Bob Roberge. The MITRE Corporation (www.mitre.org)
maintains CVE and provides impartial technical guidance to the CVE
Editorial Board on all matters related to ongoing development of
CVE.

To unsubscribe from the CVE-Announce e-newsletter, open a new
email message and copy the following text to the BODY of the
message "SIGNOFF CVE-Announce-list", then send the message to:
listserv@lists.mitre.org. To subscribe, send an email message to
listserv@lists.mitre.org with the following text in the BODY of
the message: "SUBSCRIBE CVE-Announce-List".

Copyright 2009, The MITRE Corporation. CVE and the CVE logo are
registered trademarks of The MITRE Corporation.

For more information about CVE, visit the CVE Web site at
http://cve.mitre.org or send an email to cve@mitre.org. Learn more
about Making Security Measurable at
http://measurablesecurity.mitre.org.

CVE Announce - March 6, 2009 (opt-in newsletter from the CVE Web site)

Welcome to the latest edition of the CVE-Announce e-newsletter.
This email newsletter is designed to bring recent news about CVE,
such as new versions, upcoming conferences, new Web site features,
etc. right to your emailbox. Common Vulnerabilities and Exposures
(CVE) is the standard for information security vulnerability
names. CVE content results from the collaborative efforts of the
CVE Editorial Board, which is comprised of leading representatives
from the information security community. Details on subscribing
(and unsubscribing) to the email newsletter are at the end. Please
feel free to pass this newsletter on to interested colleagues.

Comments: cve@mitre.org

-------------------------------------------------------
CVE-Announce e-newsletter/March 6, 2009
-------------------------------------------------------

Contents:

1. Feature Story
2. Hot Topic
3. UPCOMING EVENT
4. Also in this Issue
5. Details/Credits + Subscribing and Unsubscribing

FEATURE STORY:

CVE List Surpasses 35,000 CVE Identifiers

The CVE Web site now contains 35,299 unique information security
issues with publicly known names. CVE, which began in 1999 with
just 321 common names on the CVE List, is considered the
international standard for public software vulnerability names.
Information security professionals and product vendors from around
the world use CVE Identifiers (CVE-IDs) as a standard method for
identifying vulnerabilities, and for cross-linking among products,
services, and other repositories that use the identifiers.

The widespread adoption of CVE in enterprise security is
illustrated by the numerous CVE-Compatible Products and Services
in use throughout industry, government, and academia for
vulnerability management, vulnerability alerting, intrusion
detection, and patch management. Major OS vendors and other
organizations from around the world also include CVE-IDs in their
security alerts to ensure that the international community
benefits by having the identifiers as soon as a problem is
announced. CVE-IDs are also used to uniquely identify
vulnerabilities in public watch lists such as the SANS Top 20 Most
Critical Internet Security Vulnerabilities and OWASP Top 10 Web
Application Security Issues.

CVE has also inspired new efforts. MITRE's Common Weakness
Enumeration (CWE) dictionary of software weakness types is based
in part on the CVE List, and its Open Vulnerability and Assessment
Language (OVAL) effort uses CVE-IDs for its standardized OVAL
Vulnerability Definitions that test systems for the presence of
CVEs. In addition, the U.S. National Vulnerability Database (NVD)
of CVE fix information that is synchronized with and based on the
CVE List also includes Security Content Automation Protocol (SCAP)
content. SCAP employs community standards to enable "automated
vulnerability management, measurement, and policy compliance
evaluation (e.g., FISMA compliance)," and CVE is one of the six
existing open standards SCAP uses for enumerating, evaluating, and
measuring the impact of software problems and reporting results.

Each of the 35,000+ identifiers on the CVE List includes the
following: CVE Identifier number (i.e., "CVE-1999-0067");
indication of "entry" or "candidate" status; brief description of
the security vulnerability; and pertinent references such as
vulnerability reports and advisories or OVAL-ID. Visit the CVE
List page to download the complete list in various formats or to
look-up an individual identifier. Fix information and enhanced
searching of CVE is available from NVD.

LINKS:

CVE List - http://cve.mitre.org/cve

National Vulnerability Database (NVD) - http://nvd.nist.gov

---------------------------------------------------------------
HOT TOPIC:

CVE Mentioned in Top Twenty Most Critical Security Controls
Document

CVE was mentioned in Draft 1.0 of the "Twenty Most Important
Controls and Metrics for Effective Cyber Defense and Continuous
FISMA Compliance" consensus list released by a consortium of
federal agencies and private organizations on February 23, 2009.
The document, which uses "knowledge of actual attacks and defines
controls that would have stopped those attacks from being
successful," includes 15 critical controls that are subject to
automated measurement and validation and an additional 5 critical
controls that are not.

CVE is mentioned as follows in a section about why the list is so
important for chief information security officers (CISOs), chief
information officers (CIOs), federal inspectors general, and
auditors: "This effort also takes advantage of the success and
insights from the development and usage of standardized concepts
for identifying, communicating, and documenting security-relevant
characteristics/data. These standards include the following:
common identification of vulnerabilities (Common Vulnerabilities
and Exposures-CVE), definition of secure configurations (Common
Configuration Enumeration-CCE), inventory of systems and platforms
(Common Platform Enumeration-CPE), vulnerability severity (Common
Vulnerability Scoring System-CVSS) and identification of
application weaknesses (Common Weaknesses Enumeration-CWE). These
standards have emerged over the last decade through collaborative
research and deliberation between government, academia and
industry. While still evolving, several of these efforts in
standardization have made their way into commercial solutions and
government, industry, and academic usage. Perhaps most visible of
these has been the Federal Desktop Core Configuration (FDCC) which
leveraged the Security Content Automation Program (SCAP)."

The draft is available for public review and comment at
www.sans.org/cag, www.csis.org, and www.gilligangroupinc.com until
March 23, 2009.

LINK:

Top Twenty Most Critical Security Controls Document, Draft 1.0 -
http://www.sans.org/cag/guidelines.php

---------------------------------------------------------------
UPCOMING EVENT:

MITRE to Host "Making Security Measurable" Booth at "InfoSec World
2009," March 9-10

MITRE is scheduled to host a Making Security Measurable booth at
MIS Training Institute's (MISTI) "InfoSec World Conference & Expo
2009" at the Disney Coronado Springs Resort, in Orlando, Florida,
USA, on March 9-10, 2009. Please stop by booth 531 and say hello.

Visit the CVE Calendar for information on this and other events.

LINKS:

"InfoSec World 2009" -
http://www.misti.com/default.asp?page=65&Return=70&ProductID=5539

Making Security Measurable - http://measurablesecurity.mitre.org

CVE Calendar - http://cve.mitre.org/news/calendar.html

---------------------------------------------------------------
ALSO IN THIS ISSUE:

* SoftRun, Inc. Makes Declaration of CVE Compatibility

Read these stories and more news at http://cve.mitre.org/news

---------------------------------------------------------------
Details/Credits + Subscribing and Unsubscribing

Managing Editor: David Mann, Information Security Technical
Center. Writer: Bob Roberge. The MITRE Corporation (www.mitre.org)
maintains CVE and provides impartial technical guidance to the CVE
Editorial Board on all matters related to ongoing development of
CVE.

To unsubscribe from the CVE-Announce e-newsletter, open a new
email message and copy the following text to the BODY of the
message "SIGNOFF CVE-Announce-list", then send the message to:
listserv@lists.mitre.org. To subscribe, send an email message to
listserv@lists.mitre.org with the following text in the BODY of
the message: "SUBSCRIBE CVE-Announce-List".

Copyright 2009, The MITRE Corporation. CVE and the CVE logo are
registered trademarks of The MITRE Corporation.

For more information about CVE, visit the CVE Web site at
http://cve.mitre.org or send an email to cve@mitre.org. Learn more
about Making Security Measurable at
http://measurablesecurity.mitre.org.