{"id":3368,"date":"2017-06-23T19:19:39","date_gmt":"2017-06-23T11:19:39","guid":{"rendered":"https:\/\/ixyzero.com\/blog\/?p=3368"},"modified":"2017-06-30T21:12:51","modified_gmt":"2017-06-30T13:12:51","slug":"%e9%80%9a%e7%94%a8%e6%bc%8f%e6%b4%9e%e8%af%84%e5%88%86%e7%b3%bb%e7%bb%9fcvss","status":"publish","type":"post","link":"https:\/\/ixyzero.com\/blog\/archives\/3368.html","title":{"rendered":"\u901a\u7528\u6f0f\u6d1e\u8bc4\u5206\u7cfb\u7edf(CVSS)"},"content":{"rendered":"

=Start=<\/p>\n

\u7f18\u7531\uff1a<\/h4>\n

\u4e86\u89e3CVE\u6f0f\u6d1e\u7684\u8bc4\u5206\u673a\u5236\uff0c\u597d\u5728\u4ee5\u540e\u51fa\u73b0\u4e86\u6f0f\u6d1e\u7684\u65f6\u5019\u5229\u7528CVSS\u6807\u51c6\u5bf9\u8be5\u6f0f\u6d1e\u7684\u5b9e\u9645\u5f71\u54cd\u8fdb\u884c\u8bc4\u4f30\uff0c\u4ece\u800c\u6307\u5bfc\u8fdb\u884c\u4e0b\u4e00\u6b65\u64cd\u4f5c\u3002<\/p>\n

\u6b63\u6587\uff1a<\/h4>\n

\u53c2\u8003\u89e3\u7b54\uff1a<\/h5>\n
CVSS\u7684\u5ea6\u91cf\u6307\u6807<\/h6>\n

CVSS\u7531\u4e09\u4e2a\u5ea6\u91cf\u7ec4\uff1a\u300c\u57fa\u7840-Base<\/strong><\/span>\u300d\uff0c\u300c\u65f6\u95f4-Temporal<\/strong>\u300d\u548c\u300c\u73af\u5883-Environmental<\/strong>\u300d\u7ec4\u6210\uff0c\u6bcf\u4e00\u7ec4\u53c8\u7531\u4e00\u4e9b\u5ea6\u91cf\u6307\u6807\u7ec4\u6210\uff0c\u5982\u4e0b\u6240\u793a\uff1a<\/p>\n

\"\"<\/p>\n

\u4e0b\u9762\u5206\u522b\u6765\u89e3\u6790\u5404\u4e2a\u5ea6\u91cf\u6307\u6807\u7684\u542b\u4e49\u548c\u610f\u4e49\uff1a<\/p>\n

\u57fa\u7840\u5ea6\u91cf\u7ec4<\/span><\/strong>\u53cd\u6620\u4e86\u4e00\u4e2a\u6f0f\u6d1e\u7684\u56fa\u6709\u7279\u5f81\u2014\u2014\u5b83\u4e0d\u968f\u7740\u65f6\u95f4\u548c\u7528\u6237\u73af\u5883\u7684\u53d8\u5316\u800c\u53d8\u5316<\/span>\u3002<\/span>\u5b83\u7531\u4e24\u7ec4\u6307\u6807\u7ec4\u6210\uff1a\u53ef\u5229\u7528\u6307\u6807<\/strong>\u548c\u5f71\u54cd\u6307\u6807<\/strong>\u3002<\/p>\n

\u53ef\u5229\u7528\u6307\u6807<\/strong>\u53cd\u6620\u4e86\u6f0f\u6d1e\u53ef\u4ee5\u88ab\u5229\u7528\u7684\u7b80\u5355\u7a0b\u5ea6\u548c\u6280\u672f\u624b\u6bb5\u3002\u4e5f\u5c31\u662f\u8bf4\uff0c\u5b83\u4eec\u4ee3\u8868\u4e86\u6f0f\u6d1e\u6613\u53d7\u5229\u7528\u7684\u7279\u5f81\uff0c\u6211\u4eec\u628a\u5b83\u79f0\u4e3a\u8106\u5f31\u7684\u90e8\u5206\u3002\u53e6\u4e00\u65b9\u9762\uff0c\u5f71\u54cd\u6307\u6807<\/strong>\u53cd\u6620\u4e86\u6210\u529f\u5229\u7528\u8be5\u6f0f\u6d1e\u53ef\u4ee5\u5bfc\u81f4\u7684\u76f4\u63a5\u7ed3\u679c\uff0c\u4ee5\u53ca\u53d7\u8be5\u5f71\u54cd\u4ea7\u751f\u7684\u540e\u7eed\u7ed3\u679c\uff0c\u6211\u4eec\u5c06\u5176\u6b63\u5f0f\u79f0\u4e3a\u53d7\u5f71\u54cd\u7684\u7ec4\u4ef6\u3002<\/p>\n

\u867d\u7136\u8106\u5f31\u7684\u7ec4\u4ef6\u901a\u5e38\u662f\u4e00\u4e2a\u8f6f\u4ef6\u5e94\u7528\u7a0b\u5e8f\u3001\u6a21\u5757\u3001\u9a71\u52a8\u7a0b\u5e8f\u7b49\u7b49(\u751a\u81f3\u53ef\u80fd\u662f\u4e00\u4e2a\u786c\u4ef6\u8bbe\u5907)\uff0c\u4f46\u53d7\u5f71\u54cd\u7684\u7ec4\u4ef6\u53ef\u80fd\u662f\u4e00\u4e2a\u8f6f\u4ef6\u5e94\u7528\u7a0b\u5e8f\u3001\u4e00\u4e2a\u786c\u4ef6\u8bbe\u5907\u6216\u4e00\u4e2a\u7f51\u7edc\u8d44\u6e90\u3002\u8861\u91cf\u4e00\u4e2a\u8106\u5f31\u7ec4\u4ef6\u4e4b\u5916\u7684\u5f31\u70b9\u7684\u6f5c\u5728\u5f71\u54cd\uff0c\u662fCVSS v3.0\u7684\u4e00\u4e2a\u5173\u952e\u7279\u6027\u3002<\/p>\n

\n\n\n\n<\/colgroup>\n\n\n\n\n\n\n\n\n\n\n\n\n\n
\u57fa\u7840\u5206\u6570\uff08\u5fc5\u987b\uff09<\/th>\n<\/tr>\n
\u53ef\u5229\u7528\u6027\u6307\u6807(Exploitability Metrics)<\/strong><\/span><\/td>\n<\/tr>\n
\u653b\u51fb\u5411\u91cf(AV)<\/td>\n\u7f51\u7edc(N) \u76f8\u90bb(A) \u672c\u5730(L) \u7269\u7406(P)<\/td>\n<\/tr>\n
\u653b\u51fb\u7684\u590d\u6742\u6027(AC)<\/td>\n\u4f4e(L) \u9ad8(H)<\/td>\n<\/tr>\n
\u6240\u9700\u7684\u7279\u6743(PR)<\/td>\n\u6ca1\u6709(N) \u4f4e(L) \u9ad8(H)<\/td>\n<\/tr>\n
\u7528\u6237\u4ea4\u4e92(UI)<\/td>\n\u6ca1\u6709(N) \u8981\u6c42(R)<\/td>\n<\/tr>\n
\u8303\u56f4(Scope)<\/strong><\/td>\n<\/tr>\n
\u8303\u56f4(S)<\/td>\n\u4e0d\u53d8(U) \u6539\u53d8(C)<\/td>\n<\/tr>\n
\u5f71\u54cd\u6307\u6807(Impact Metrics)<\/strong><\/span><\/td>\n<\/tr>\n
\u673a\u5bc6\u6027(C)<\/td>\n\u6ca1\u6709(N) \u4f4e(L) \u9ad8(H)<\/td>\n<\/tr>\n
\u5b8c\u6574\u6027(I)<\/td>\n\u6ca1\u6709(N) \u4f4e(L) \u9ad8(H)<\/td>\n<\/tr>\n
\u53ef\u7528\u6027(A)<\/td>\n\u6ca1\u6709(N) \u4f4e(L) \u9ad8(H)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

\u65f6\u95f4\u5ea6\u91cf\u7ec4<\/strong><\/span>\u53cd\u6620\u4e86\u4e00\u4e2a\u53ef\u80fd\u968f\u65f6\u95f4\u800c\u53d8\u5316\u7684\u6f0f\u6d1e\u7684\u7279\u5f81<\/span>\uff0c\u4f46\u662f\u4e0d\u8de8\u7528\u6237\u73af\u5883\u3002\u4f8b\u5982\uff0c\u4e00\u4e2a\u6613\u4e8e\u4f7f\u7528\u7684\u6f0f\u6d1e\u5229\u7528\u5de5\u5177\u5305\u7684\u51fa\u73b0\u4f1a\u589e\u52a0CVSS\u5206\u6570\uff0c\u800c\u4e00\u4e2a\u5b98\u65b9\u8865\u4e01\u7684\u521b\u5efa\u5c06\u4f1a\u51cf\u5c11\u5b83\u3002<\/p>\n

\n\n\n\n<\/colgroup>\n\n\n\n\n\n
\u65f6\u95f4\u5206\u6570\uff08\u53ef\u9009\uff09<\/th>\n<\/tr>\n
\u5229\u7528\u4ee3\u7801\u7684\u6210\u719f\u5ea6(E)<\/td>\n\u672a\u5b9a\u4e49(X) \u672a\u7ecf\u9a8c\u8bc1(U) PoC(P) \u51fd\u6570(F) \u9ad8(H)<\/td>\n<\/tr>\n
\u4fee\u590d\u7ea7\u522b(RL)<\/td>\n\u672a\u5b9a\u4e49(X) \u5b98\u65b9\u4fee\u590d(O) \u4e34\u65f6\u4fee\u590d(T) \u5de5\u4f5c\u533a(W) \u4e0d\u53ef\u7528(U)<\/td>\n<\/tr>\n
\u62a5\u544a\u7684\u53ef\u4fe1\u5ea6(RC)<\/td>\n\u672a\u5b9a\u4e49(X) \u672a\u77e5(U) \u5408\u7406(R) \u786e\u8ba4(C)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

\u73af\u5883\u5ea6\u91cf\u7ec4<\/strong><\/span>\u4ee3\u8868\u4e86\u4e00\u4e2a\u4e0e\u67d0\u4e2a\u7279\u5b9a\u7528\u6237\u73af\u5883\u76f8\u5173\u4e14\u72ec\u7279\u7684\u6f0f\u6d1e\u7684\u7279\u5f81<\/span>\u3002\u8fd9\u4e9b\u5ea6\u91cf\u6807\u51c6\u5141\u8bb8\u5206\u6790\u4eba\u5458\u5408\u5e76\u5b89\u5168\u63a7\u5236\uff0c\u8fd9\u4e9b\u63a7\u5236\u53ef\u4ee5\u51cf\u8f7b\u4efb\u4f55\u540e\u679c\uff0c\u4e5f\u53ef\u4ee5\u6839\u636e\u5979\u7684\u4e1a\u52a1\u98ce\u9669\u4fc3\u8fdb\u6216\u964d\u4f4e\u4e00\u4e2a\u8106\u5f31\u7cfb\u7edf\u7684\u91cd\u8981\u6027\u3002<\/p>\n

\n\n\n\n<\/colgroup>\n\n\n\n\n\n\n
\u73af\u5883\u5206\u6570\uff08\u53ef\u9009\uff09<\/th>\n<\/tr>\n
\u673a\u5bc6\u6027\u8981\u6c42(CR)<\/td>\n\u672a\u5b9a\u4e49(X) \u4f4e(L) \u4e2d(M) \u9ad8(H)<\/td>\n<\/tr>\n
\u5b8c\u6574\u6027\u8981\u6c42(IR)<\/td>\n\u672a\u5b9a\u4e49(X) \u4f4e(L) \u4e2d(M) \u9ad8(H)<\/td>\n<\/tr>\n
\u53ef\u7528\u6027\u8981\u6c42(AR)<\/td>\n\u672a\u5b9a\u4e49(X) \u4f4e(L) \u4e2d(M) \u9ad8(H)<\/td>\n<\/tr>\n
\u4fee\u6539\u57fa\u7840\u5ea6\u91cf\u6307\u6807<\/p>\n

(Modified Base Metrics)<\/td>\n

Modified Attack Vector (MAV)
\nModified Attack Complexity (MAC)
\nModified Privileges Required (MPR)
\nModified User Interaction (MUI)
\nModified Scope (MS)
\nModified Confidentiality (MC)
\nModified Integrity (MI)
\nModified Availability (MA)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n
CVSS\u7684\u6253\u5206\u65b9\u7a0b<\/h6>\n

\"\"<\/p>\n

 <\/p>\n

CVSS\u7684\u6253\u5206\u8303\u56f4<\/h6>\n\n\n\n\n\n\n\n\n\n
RATING<\/th>\nCVSS SCORE<\/th>\n<\/tr>\n<\/thead>\n
None<\/td>\n0.0<\/td>\n<\/tr>\n
Low<\/td>\n0.1 – 3.9<\/td>\n<\/tr>\n
Medium<\/td>\n4.0 – 6.9<\/td>\n<\/tr>\n
High<\/span><\/strong><\/td>\n7.0 – 8.9<\/span><\/td>\n<\/tr>\n
Critical<\/span><\/strong><\/td>\n9.0 – 10.0<\/span><\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
CVSS\u7684\u5404\u6307\u6807\u7684\u6743\u91cd<\/h6>\n\n\n\n\n\n\n\n\n\n\n\n\n\n
METRIC<\/th>\nMETRIC VALUE<\/th>\nNUMERICAL VALUE<\/th>\n<\/tr>\n<\/thead>\n
Attack Vector \/ Modified Attack Vector<\/td>\nNetwork<\/strong><\/span>
\nAdjacent
\nLocal<\/strong><\/span>
\nPhysical<\/td>\n		0.85<\/span><\/strong>
\n0.62
\n0.55<\/span><\/strong>
\n0.2<\/td>\n<\/tr>\n
Attack Complexity \/ Modified Attack Complexity<\/td>\nLow
\nHigh<\/td>\n		0.77
\n0.44<\/td>\n<\/tr>\n
Privilege Required \/ Modified Privilege Required<\/td>\nNone
\nLow
\nHigh<\/td>\n		0.85
\n0.62 (0.68 if Scope \/ Modified Scope is Changed)
\n0.27 (0.50 if Scope \/ Modified Scope is Changed)<\/td>\n<\/tr>\n
User Interaction \/ Modified User Interaction<\/td>\nNone
\nRequired<\/td>\n		0.85
\n0.62<\/td>\n<\/tr>\n
C,I,A Impact \/ Modified C,I,A Impact<\/td>\nHigh<\/span><\/strong>
\nLow
\nNone<\/span><\/strong><\/td>\n		0.56<\/strong><\/span>
\n0.22
\n0<\/strong><\/span><\/td>\n<\/tr>\n
Exploit Code Maturity Not Defined 1<\/td>\nHigh
\nFunctional
\nProof of Concept
\nUnproven<\/td>\n		1
\n0.97
\n0.94
\n0.91<\/td>\n<\/tr>\n
Remediation Level<\/td>\nNot Defined
\nUnavailable
\nWorkaround
\nTemporary Fix
\nOfficial Fix<\/td>\n		1
\n1
\n0.97
\n0.96
\n0.95<\/td>\n<\/tr>\n
Report Confidence<\/td>\nNot Defined
\nConfirmed
\nReasonable
\nUnknown<\/td>\n		1
\n1
\n0.96
\n0.92<\/td>\n<\/tr>\n
Security Requirements \u2013 C,I,A Requirements (CR)<\/td>\nNot Defined
\nHigh
\nMedium
\nLow<\/td>\n		1
\n1.5
\n1
\n0.5<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\u53c2\u8003\u94fe\u63a5\uff1a<\/h5>\n