[Secure-testing-team] Comparing NVD and Debian CVE tracking

Petter Reinholdtsen
2011-01-28T00:18:07Z

As I mentioned on IRC and debian-devel@, I have spend some time
recently to try to set up a framework for comparing the set of
affected packages reported by NVD and the Debian CVE list, and this
work is starting to bring some useful results.

I''ve created a mapping between Debian source packages and CPE entries
used in the CVE information in NVD.  The result is in the
secure-testing subversion tree, data/CPE/list.  The data is probably
not 100% accurate, but close enough to be useful.

One part of the check is to loo in NVD for affected packages
represented by CPEs, and for every CPE also listed as a source package
in Debian, report a warning if the Debian source package is not listed
as affected in data/CVE/list.

The first reported issue  inform that
<URL: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4530 >
list cpe:/a:muscle:pcsc-lite (Debian source package pcsc-lite) as
affected, but the CVE entry for Debian do not say anything about this
package.  The latter look like this:

  CVE-2010-4530 (Signedness error in ccid_serial.c in libccid in the
  USB Chip/Smart ...)
	- ccid 1.3.11-2 (unimportant; bug #607780)
	NOTE: CVE requested, http://seclists.org/oss-sec/2010/q4/356
	NOTE: Theoretical attack

I have not evaluated these issues, and would very much like feedback
on this approach.  I am aware that these issues might be bugs in
either NVD or in the Debian CVE info, and believe the only way to
figure out is to check each one.

Here is the complete list of such issues for the time period
2011-2008.  There are 93 such issues reported at the moment.

warning: CVE-2010-4530 in NVD is not refering to cpe:/a:muscle:pcsc-lite found
in Debian.
warning: CVE-2010-3975 in NVD is not refering to cpe:/a:adobe:flash_player found
in Debian.
warning: CVE-2010-3490 in NVD is not refering to cpe:/a:freepbx:freepbx found in
Debian.
warning: CVE-2010-3205 in NVD is not refering to cpe:/a:textpattern:textpattern
found in Debian.
warning: CVE-2010-3192 in NVD is not refering to cpe:/a:gnu:glibc found in
Debian.
warning: CVE-2010-2530 in NVD is not refering to cpe:/o:freebsd:freebsd found in
Debian.
warning: CVE-2010-1988 in NVD is not refering to cpe:/a:mozilla:firefox found in
Debian.
warning: CVE-2010-1987 in NVD is not refering to cpe:/a:mozilla:firefox found in
Debian.
warning: CVE-2010-1986 in NVD is not refering to cpe:/a:mozilla:firefox found in
Debian.
warning: CVE-2010-1585 in NVD is not refering to cpe:/a:mozilla:firefox found in
Debian.
warning: CVE-2010-1516 in NVD is not refering to cpe:/a:swftools:swftools found
in Debian.
warning: CVE-2010-1215 in NVD is not refering to cpe:/a:mozilla:thunderbird
found in Debian.
warning: CVE-2010-1207 in NVD is not refering to cpe:/a:mozilla:thunderbird
found in Debian.
warning: CVE-2010-0378 in NVD is not refering to cpe:/a:adobe:flash_player found
in Debian.
warning: CVE-2009-4855 in NVD is not refering to cpe:/a:typo3:typo3 found in
Debian.
warning: CVE-2009-4630 in NVD is not refering to cpe:/a:mozilla:thunderbird
found in Debian.
warning: CVE-2009-4130 in NVD is not refering to cpe:/a:mozilla:firefox found in
Debian.
warning: CVE-2009-4129 in NVD is not refering to cpe:/a:mozilla:firefox found in
Debian.
warning: CVE-2009-4102 in NVD is not refering to cpe:/a:mozilla:firefox found in
Debian.
warning: CVE-2009-4066 in NVD is not refering to cpe:/a:drupal:drupal found in
Debian.
warning: CVE-2009-3984 in NVD is not refering to cpe:/a:mozilla:thunderbird
found in Debian.
warning: CVE-2009-3983 in NVD is not refering to cpe:/a:mozilla:thunderbird
found in Debian.
warning: CVE-2009-3982 in NVD is not refering to cpe:/a:mozilla:thunderbird
found in Debian.
warning: CVE-2009-3981 in NVD is not refering to cpe:/a:mozilla:thunderbird
found in Debian.
warning: CVE-2009-3980 in NVD is not refering to cpe:/a:mozilla:thunderbird
found in Debian.
warning: CVE-2009-3976 in NVD is not refering to cpe:/a:proftpd:proftpd found in
Debian.
warning: CVE-2009-3479 in NVD is not refering to cpe:/a:drupal:drupal found in
Debian.
warning: CVE-2009-3156 in NVD is not refering to cpe:/a:drupal:drupal found in
Debian.
warning: CVE-2009-3014 in NVD is not refering to cpe:/a:mozilla:seamonkey found
in Debian.
warning: CVE-2009-3010 in NVD is not refering to cpe:/a:mozilla:seamonkey found
in Debian.
warning: CVE-2009-3007 in NVD is not refering to cpe:/a:mozilla:firefox found in
Debian.
warning: CVE-2009-2975 in NVD is not refering to cpe:/a:mozilla:firefox found in
Debian.
warning: CVE-2009-2696 in NVD is not refering to cpe:/a:apache:tomcat found in
Debian.
warning: CVE-2009-2479 in NVD is not refering to cpe:/a:mozilla:firefox found in
Debian.
warning: CVE-2009-2478 in NVD is not refering to cpe:/a:mozilla:firefox found in
Debian.
warning: CVE-2009-2477 in NVD is not refering to cpe:/a:mozilla:firefox found in
Debian.
warning: CVE-2009-2464 in NVD is not refering to cpe:/a:mozilla:seamonkey found
in Debian.
warning: CVE-2009-2409 in NVD is not refering to cpe:/a:mozilla:firefox found in
Debian.
warning: CVE-2009-2030 in NVD is not refering to cpe:/a:sun:jdk found in Debian.
warning: CVE-2009-1955 in NVD is not refering to cpe:/a:apache:http_server found
in Debian.
warning: CVE-2009-1840 in NVD is not refering to cpe:/a:mozilla:thunderbird
found in Debian.
warning: CVE-2009-1840 in NVD is not refering to cpe:/a:mozilla:seamonkey found
in Debian.
warning: CVE-2009-1828 in NVD is not refering to cpe:/a:mozilla:firefox found in
Debian.
warning: CVE-2009-1827 in NVD is not refering to cpe:/a:mozilla:firefox found in
Debian.
warning: CVE-2009-1690 in NVD is not refering to cpe:/a:google:chrome found in
Debian.
warning: CVE-2009-1597 in NVD is not refering to cpe:/a:mozilla:firefox found in
Debian.
warning: CVE-2009-1313 in NVD is not refering to cpe:/a:mozilla:firefox found in
Debian.
warning: CVE-2009-1312 in NVD is not refering to cpe:/a:mozilla:seamonkey found
in Debian.
warning: CVE-2009-1309 in NVD is not refering to cpe:/a:mozilla:thunderbird
found in Debian.
warning: CVE-2009-1309 in NVD is not refering to cpe:/a:mozilla:seamonkey found
in Debian.
warning: CVE-2009-1308 in NVD is not refering to cpe:/a:mozilla:thunderbird
found in Debian.
warning: CVE-2009-1308 in NVD is not refering to cpe:/a:mozilla:seamonkey found
in Debian.
warning: CVE-2009-1307 in NVD is not refering to cpe:/a:mozilla:seamonkey found
in Debian.
warning: CVE-2009-1306 in NVD is not refering to cpe:/a:mozilla:thunderbird
found in Debian.
warning: CVE-2009-1306 in NVD is not refering to cpe:/a:mozilla:seamonkey found
in Debian.
warning: CVE-2009-1047 in NVD is not refering to cpe:/a:drupal:drupal found in
Debian.
warning: CVE-2009-1044 in NVD is not refering to cpe:/a:mozilla:firefox found in
Debian.
warning: CVE-2009-0733 in NVD is not refering to cpe:/a:mozilla:firefox found in
Debian.
warning: CVE-2009-0733 in NVD is not refering to cpe:/a:gimp:gimp found in
Debian.
warning: CVE-2009-0723 in NVD is not refering to cpe:/a:mozilla:firefox found in
Debian.
warning: CVE-2009-0723 in NVD is not refering to cpe:/a:gimp:gimp found in
Debian.
warning: CVE-2009-0689 in NVD is not refering to cpe:/a:mozilla:seamonkey found
in Debian.
warning: CVE-2009-0581 in NVD is not refering to cpe:/a:mozilla:firefox found in
Debian.
warning: CVE-2009-0581 in NVD is not refering to cpe:/a:gimp:gimp found in
Debian.
warning: CVE-2009-0253 in NVD is not refering to cpe:/a:mozilla:firefox found in
Debian.
warning: CVE-2008-6699 in NVD is not refering to cpe:/a:typo3:typo3 found in
Debian.
warning: CVE-2008-5915 in NVD is not refering to cpe:/a:google:chrome found in
Debian.
warning: CVE-2008-4724 in NVD is not refering to cpe:/a:google:chrome found in
Debian.
warning: CVE-2008-4395 in NVD is not refering to cpe:/o:linux:kernel found in
Debian.
warning: CVE-2008-4247 in NVD is not refering to cpe:/o:freebsd:freebsd found in
Debian.
warning: CVE-2008-4226 in NVD is not refering to cpe:/a:xmlsoft:libxml found in
Debian.
warning: CVE-2008-4225 in NVD is not refering to cpe:/a:xmlsoft:libxml found in
Debian.
warning: CVE-2008-4120 in NVD is not refering to cpe:/a:flatpress:flatpress
found in Debian.
warning: CVE-2008-3873 in NVD is not refering to cpe:/a:adobe:flash_player found
in Debian.
warning: CVE-2008-2579 in NVD is not refering to cpe:/a:apache:http_server found
in Debian.
warning: CVE-2008-2464 in NVD is not refering to cpe:/o:freebsd:freebsd found in
Debian.
warning: CVE-2008-2452 in NVD is not refering to cpe:/a:typo3:typo3 found in
Debian.
warning: CVE-2008-2451 in NVD is not refering to cpe:/a:typo3:typo3 found in
Debian.
warning: CVE-2008-2450 in NVD is not refering to cpe:/a:typo3:typo3 found in
Debian.
warning: CVE-2008-2419 in NVD is not refering to cpe:/a:mozilla:firefox found in
Debian.
warning: CVE-2008-2182 in NVD is not refering to cpe:/a:typo3:typo3 found in
Debian.
warning: CVE-2008-1810 in NVD is not refering to cpe:/a:sap:maxdb found in
Debian.
warning: CVE-2008-0732 in NVD is not refering to cpe:/a:apache:geronimo found in
Debian.
warning: CVE-2008-0646 in NVD is not refering to
cpe:/a:rasterbar_software:libtorrent found in Debian.
warning: CVE-2008-0618 in NVD is not refering to cpe:/a:wordpress:wordpress
found in Debian.
warning: CVE-2008-0617 in NVD is not refering to cpe:/a:wordpress:wordpress
found in Debian.
warning: CVE-2008-0616 in NVD is not refering to cpe:/a:wordpress:wordpress
found in Debian.
warning: CVE-2008-0615 in NVD is not refering to cpe:/a:wordpress:wordpress
found in Debian.
warning: CVE-2008-0491 in NVD is not refering to cpe:/a:wordpress:wordpress
found in Debian.
warning: CVE-2008-0462 in NVD is not refering to cpe:/a:drupal:drupal found in
Debian.
warning: CVE-2008-0358 in NVD is not refering to cpe:/a:pixelpost:pixelpost
found in Debian.
warning: CVE-2008-0238 in NVD is not refering to cpe:/a:xine:xine-lib found in
Debian.
warning: CVE-2008-0198 in NVD is not refering to cpe:/a:wordpress:wordpress
found in Debian.