{"id":3370,"date":"2017-06-23T19:44:48","date_gmt":"2017-06-23T11:44:48","guid":{"rendered":"https:\/\/ixyzero.com\/blog\/?p=3370"},"modified":"2017-07-15T10:36:16","modified_gmt":"2017-07-15T02:36:16","slug":"%e7%90%86%e8%a7%a3redhat%e7%9a%84%e6%bc%8f%e6%b4%9e%e8%af%84%e5%88%86%e5%92%8cnvd%e7%9a%84%e5%b7%ae%e5%bc%82","status":"publish","type":"post","link":"https:\/\/ixyzero.com\/blog\/archives\/3370.html","title":{"rendered":"\u7406\u89e3RedHat\u7684\u6f0f\u6d1e\u8bc4\u5206\u548cNVD\u7684\u5dee\u5f02"},"content":{"rendered":"<p>=Start=<\/p>\n<h4>\u7f18\u7531\uff1a<\/h4>\n<p>NVD\u548cRedHat\u5bf9 <a href=\"http:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2017-8890\">CVE-2017-8890<\/a> \u6f0f\u6d1e\u7684\u8bc4\u5206\u5dee\u5f02\uff1a<\/p>\n<p><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2017-8890\">NVD<\/a>\u7ed9\u51fa\u7684 <code>Base Score<\/code> \u4e3a 9.8\uff0c <code>Vector String<\/code> \u4e3a\uff1a<br \/>\nCVSS:3.0\/<span style=\"color: #ff0000;\"><strong>AV:N<\/strong><\/span>\/AC:L\/PR:N\/UI:N\/S:U\/<strong><span style=\"color: #ff0000;\">C:H<\/span><\/strong>\/<strong><span style=\"color: #ff0000;\">I:H<\/span><\/strong>\/A:H (legend)<\/p>\n<p><a href=\"https:\/\/access.redhat.com\/security\/cve\/cve-2017-8890\">RedHat<\/a>\u7ed9\u51fa\u7684 <code>Base Score<\/code> \u4e3a 5.5\uff0c <code>Vector String<\/code> \u4e3a\uff1a<br \/>\nCVSS:3.0\/<strong><span style=\"color: #ff0000;\">AV:L<\/span><\/strong>\/AC:L\/PR:L\/UI:N\/S:U\/<strong><span style=\"color: #ff0000;\">C:N<\/span><\/strong>\/<strong><span style=\"color: #ff0000;\">I:N<\/span><\/strong>\/A:H<\/p>\n<h4>\u6b63\u6587\uff1a<\/h4>\n<h5>\u53c2\u8003\u89e3\u7b54\uff1a<\/h5>\n<p>\u300cRedHat\u4ea7\u54c1\u98ce\u9669\u8bc4\u5206\u300d\u548c\u300c\u5e38\u89c1\u7684\u6f0f\u6d1e\u8bc4\u5206\u7cfb\u7edf(CVSS)\u300d\u7684\u57fa\u7840\u5f97\u5206\u63d0\u4f9b\u4e86\u4e00\u4e2a\u4f18\u5148\u7ea7\u98ce\u9669\u8bc4\u4f30\uff0c\u4ee5\u5e2e\u52a9\u60a8\u4e86\u89e3\u548c\u5b89\u6392\u7cfb\u7edf\u5347\u7ea7\uff0c\u4f7f\u60a8\u80fd\u591f\u6839\u636e\u60a8\u7684\u72ec\u7279\u73af\u5883\u5bf9\u6bcf\u4e2a\u95ee\u9898\u7684\u98ce\u9669\u4f5c\u51fa\u660e\u667a\u7684\u51b3\u7b56\u3002<\/p>\n<div class=\"table-wrap\">\n<table class=\"confluenceTable tablesorter tablesorter-default\">\n<colgroup>\n<col \/>\n<col \/><\/colgroup>\n<thead>\n<tr class=\"tablesorter-headerRow\">\n<th class=\"confluenceTh tablesorter-header sortableHeader tablesorter-headerUnSorted\" tabindex=\"0\" scope=\"col\" data-column=\"0\">\n<div class=\"tablesorter-header-inner\">SEVERITY RATING<\/div>\n<\/th>\n<th class=\"confluenceTh tablesorter-header sortableHeader tablesorter-headerUnSorted\" tabindex=\"0\" scope=\"col\" data-column=\"1\">\n<div class=\"tablesorter-header-inner\">DESCRIPTION<\/div>\n<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<th class=\"confluenceTh\">CRITICAL IMPACT<\/p>\n<p>(\u4e25\u91cd)<\/th>\n<td class=\"confluenceTd\">\u8fd9\u4e00\u8bc4\u7ea7\u662f\u7531<span style=\"color: #ff0000;\"><strong>\u8fdc\u7a0b<\/strong><\/span><span style=\"color: #0000ff;\"><strong>\u672a\u7ecf\u8eab\u4efd\u9a8c\u8bc1<\/strong><\/span>\u7684\u653b\u51fb\u8005<span style=\"color: #ff0000;\"><strong>\u5bb9\u6613\u5229\u7528<\/strong><\/span>\u7684\u7f3a\u9677\u5f15\u8d77\u7684\uff0c\u53ef\u5bfc\u81f4\u7cfb\u7edf\u5728\u4e0d\u9700\u8981\u7528\u6237\u4ea4\u4e92\u7684\u60c5\u51b5\u4e0b\u88ab\u653b\u9677\uff08\u4efb\u610f\u4ee3\u7801\u6267\u884c\uff09\u3002\u8fd9\u4e9b\u662f\u53ef\u4ee5\u88ab\u8815\u866b\u5229\u7528\u7684\u6f0f\u6d1e\u7c7b\u578b\u3002\u9700\u8981\u8eab\u4efd\u9a8c\u8bc1\u7684\u8fdc\u7a0b\u7528\u6237\uff0c\u672c\u5730\u7528\u6237\u6216\u4e0d\u592a\u53ef\u80fd\u7684\u914d\u7f6e\u7684\u7f3a\u9677\u4e0d\u4f1a\u88ab\u5f52\u7c7b\u4e3a\u4e25\u91cd\u5f71\u54cd\u3002<\/td>\n<\/tr>\n<tr>\n<th class=\"confluenceTh\">IMPORTANT IMPACT<\/p>\n<p>(\u9ad8\u5371)<\/th>\n<td class=\"confluenceTd\">\u8fd9\u4e00\u8bc4\u7ea7\u662f\u7ed9\u90a3\u4e9b\u53ef\u4ee5<span style=\"color: #ff0000;\"><strong>\u8f7b\u6613<\/strong><\/span>\u5730<strong>\u5371\u53ca\u8d44\u6e90\u7684\u673a\u5bc6\u6027\uff0c\u5b8c\u6574\u6027\u6216\u53ef\u7528\u6027<\/strong>\u7684\u6f0f\u6d1e\u7684\u3002\u8fd9\u4e9b\u6f0f\u6d1e\u4e3b\u8981\u6709\uff1a<span style=\"color: #ff0000;\">\u5141\u8bb8\u672c\u5730\u7528\u6237\u63d0\u5347\u6743\u9650\u7684\u6f0f\u6d1e<\/span>\uff0c<span style=\"color: #ff0000;\">\u5141\u8bb8\u672a\u7ecf\u8eab\u4efd\u9a8c\u8bc1\u7684\u8fdc\u7a0b\u7528\u6237\u67e5\u770b\u672c\u5e94\u7531\u8eab\u4efd\u9a8c\u8bc1\u4fdd\u62a4\u7684\u8d44\u6e90<\/span>\uff0c<strong><span style=\"color: #ff0000;\">\u5141\u8bb8\u7ecf\u8fc7\u8eab\u4efd\u9a8c\u8bc1\u7684\u8fdc\u7a0b\u7528\u6237\u6267\u884c\u4efb\u610f\u4ee3\u7801<\/span><\/strong>\uff0c\u6216<span style=\"color: #0000ff;\">\u5141\u8bb8\u8fdc\u7a0b\u7528\u6237\u5bfc\u81f4\u62d2\u7edd\u670d\u52a1<\/span>\u3002<\/td>\n<\/tr>\n<tr>\n<th class=\"confluenceTh\">MODERATE IMPACT<\/p>\n<p>(\u4e2d\u5371)<\/th>\n<td class=\"confluenceTd\">\u8fd9\u4e00\u8bc4\u7ea7\u662f\u7ed9\u90a3\u4e9b<span style=\"color: #ff0000;\"><strong>\u5229\u7528\u6761\u4ef6\u6bd4\u8f83\u82db\u523b<\/strong><\/span>\uff0c\u4f46\u4e00\u65e6\u5229\u7528\u6210\u529f\u5219\u53ef\u80fd\u5bfc\u81f4\u5bf9\u8d44\u6e90\u7684\u673a\u5bc6\u6027\uff0c\u5b8c\u6574\u6027\u6216\u53ef\u7528\u6027\u53d7\u5230\u5371\u5bb3\u7684\u6f0f\u6d1e\u3002\u8fd9\u4e9b\u662f\u53ef\u80fd\u53d7\u5230\u91cd\u5927\u5f71\u54cd\u6216\u91cd\u8981\u5f71\u54cd\u4f46\u4e0d\u592a\u6613\u4e8e\u5229\u7528\u7684\u6f0f\u6d1e\u7684\u7c7b\u578b\uff0c\u57fa\u4e8e\u5bf9\u7f3a\u9677\u7684\u6280\u672f\u8bc4\u4f30\uff0c\u6216\u5f71\u54cd\u4e0d\u592a\u53ef\u80fd\u7684\u914d\u7f6e\u3002<\/td>\n<\/tr>\n<tr>\n<th class=\"confluenceTh\"><strong>LOW IMPACT<\/strong><\/p>\n<p>(\u4f4e\u5371)<\/th>\n<td class=\"confluenceTd\">\u8fd9\u4e00\u8bc4\u7ea7\u53ef\u7528\u4e8e\u6240\u6709\u5176\u4ed6\u6709\u5b89\u5168\u5f71\u54cd\u7684\u95ee\u9898\u3002\u8fd9\u4e9b\u662f\u88ab\u8ba4\u4e3a<strong>\u4e0d\u592a\u53ef\u80fd\u88ab\u5229\u7528\u7684\u6f0f\u6d1e<\/strong>\uff0c\u6216\u8005<strong>\u5373\u4fbf\u88ab\u6210\u529f\u5229\u7528\u5f71\u54cd\u4e5f\u5f88\u5c0f\u7684\u6f0f\u6d1e<\/strong>\u3002<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<div class=\"row\">\n<div id=\"outputText\" class=\"row small_font\">\n<div class=\"translated_result\">\n<p class=\"tgt\">CVSS\u6807\u51c6\u63d0\u4f9b\u7684\u4fe1\u606f\u975e\u5e38\u6709\u7528\uff0c\u4f46\u662fRed Hat\u5e76\u4e0d\u4ec5\u4ec5\u4f7f\u7528CVSS\u7ed9\u5b9a\u7684\u7ea7\u522b\u6765\u786e\u5b9a\u54ea\u4e9b\u7f3a\u9677\/\u6f0f\u6d1e\u9700\u8981\u4f18\u5148\u4fee\u590d\u3002CVSS\u88ab\u4f5c\u4e3a\u6307\u5bfc\u539f\u5219\u7528\u4e8e\u786e\u5b9a\u7f3a\u9677\/\u6f0f\u6d1e\u7684\u5173\u952e\u6307\u6807\uff0c\u4f46\u662f\u6f0f\u6d1e\u4fee\u590d\u7684\u4f18\u5148\u7ea7\u522b\u662f\u7531\u4e0a\u9762\u63d0\u5230\u7684\u7f3a\u9677\/\u6f0f\u6d1e\u4ea7\u751f\u7684\u6574\u4f53\u5f71\u54cd\u51b3\u5b9a\u7684\u3002<\/p>\n<\/div>\n<\/div>\n<\/div>\n<h6>CVSS v3 Base Metrics<br \/>\n#CVSS v3\u57fa\u7840\u5ea6\u91cf\u6307\u6807<\/h6>\n<ul>\n<li>Attack Vector (AV) &#8211; Expresses the &#8220;remoteness&#8221; of the attack and how the vulnerability is exploited.<\/li>\n<li>Attack Complexity (AC) &#8211; Speaks to how hard the attack is to execute and what factors are needed for it to be successful. (The older Access Complexity metric is now split into Attack Complexity and User Interaction.).<\/li>\n<li>User Interaction (UI) &#8211; Determines whether the attack require an active human to participate or if the attack can be automated.<\/li>\n<li>Privileges Required (PR) &#8211; Documents the level of user authentication required for attack to be successful (replaces older Authentication metric).<\/li>\n<li>Scope (S) &#8211; Determines whether an attacker can affect a component that has a different level of authority.<\/li>\n<li>Confidentiality (C) &#8211; Determines whether data can be disclosed to non-authorized parties and, if so, to what level.<\/li>\n<li>Integrity (I) &#8211; This measures how trustworthy the data is and how far it can be trusted to not be modified by unauthorized users.<\/li>\n<li>Availability (A) &#8211; This metric is concerned with data or services being accessible to authorized users when they need to access it.<\/li>\n<\/ul>\n<h6>How Red Hat Uses CVSS v3 Base Metrics<br \/>\n#RedHat\u662f\u5982\u4f55\u4f7f\u7528CVSSv3\u7684\u57fa\u7840\u5ea6\u91cf\u6307\u6807\u7684<\/h6>\n<ul>\n<li>LIBRARIES<\/li>\n<li>WEB BROWSERS (AND ASSOCIATED PLUG-INS)<\/li>\n<li>OTHER COMMON SCORES<\/li>\n<\/ul>\n<h6>Base Score Variations Across Products<br \/>\n#\u4ea7\u54c1\u7684\u57fa\u7840\u5f97\u5206\u5dee\u5f02<\/h6>\n<p>\u2026\u2026\u7565\u2026\u2026<\/p>\n<h6><span style=\"color: #ff0000;\">Differences Between NVD and Red Hat Scores<\/span><br \/>\n<span style=\"color: #ff0000;\">#NVD\u548cRedHat\u5728\u8bc4\u5206\u4e0a\u7684\u5dee\u5f02<\/span><\/h6>\n<p><strong>\u5bf9\u4e8e\u7531\u591a\u4e2a\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5f00\u653e\u6e90\u7801\u8f6f\u4ef6\uff0cCVSS\u7684\u57fa\u7840\u5206\u6570\u53ef\u80fd\u56e0\u6bcf\u4e2a\u4f9b\u5e94\u5546\u7684\u7248\u672c\u800c\u4e0d\u540c\uff0c\u8fd9\u53d6\u51b3\u4e8e\u4ed6\u4eec\u6240\u53d1\u5e03\u7684\u7248\u672c\u3001\u4ed6\u4eec\u5982\u4f55\u53d1\u5e03\u3001\u5e73\u53f0\uff0c\u751a\u81f3\u662f\u8f6f\u4ef6\u662f\u5982\u4f55\u7f16\u8bd1\u7684\u3002<\/strong>\u8fd9\u4f7f\u5f97\u7b2c\u4e09\u65b9\u6f0f\u6d1e\u6570\u636e\u5e93\u5bf9\u6f0f\u6d1e\u7684\u8bc4\u5206\u53d8\u5f97\u56f0\u96be\uff0c\u6bd4\u5982NVD\uff0c\u5b83\u53ea\u80fd\u7ed9\u6bcf\u4e2a\u6f0f\u6d1e\u63d0\u4f9b\u4e00\u4e2a\u5355\u4e00\u7684CVSS\u57fa\u7840\u5f97\u5206\u3002<\/p>\n<p><strong>\u8fd9\u4e9b\u5dee\u5f02\u4f1a\u5bfc\u81f4(\u4e0d\u540c\u673a\u6784\u7ed9\u51fa\u7684CVSS\u8bc4\u5206)\u5206\u6570\u5dee\u5f02\u5f88\u5927\u3002<\/strong>\u4f8b\u5982\uff0cNVD\u8ba4\u4e3aFirefox\u7684\u6f0f\u6d1e\u5177\u6709\u5f88\u9ad8\u7684\u5f71\u54cd\u6307\u6807\uff0c\u56e0\u4e3aFirefox\u5e94\u7528\u7a0b\u5e8f\u4e5f\u9002\u7528\u4e8eMicrosoft Windows\u7cfb\u7edf\uff0c\u5728\u90a3\u91cc\uff0c\u7528\u6237\u4f7f\u7528\u7ba1\u7406\u5458\u6743\u9650\u8fd0\u884cFirefox\u662f\u5f88\u5e38\u89c1\u7684\u3002\u4f46\u5bf9\u4e8eRed Hat Enterprise Linux\uff0c\u6211\u4eec\u8ba4\u4e3a\u5f71\u54cd\u5ea6\u91cf\u662fLow\uff0c\u56e0\u4e3a(\u5728\u6211\u4eec\u7684\u7cfb\u7edf\u4e0a)Firefox\u5f88\u53ef\u80fd\u662f\u4ee5\u4e00\u4e2a\u6ca1\u6709\u7279\u6743\u7684\u7528\u6237\u8eab\u4efd\u8fd0\u884c\u7684\u3002<\/p>\n<p><span style=\"color: #ff0000;\"><strong>\u57fa\u4e8e\u8fd9\u4e9b\u539f\u56e0\uff0c\u6211\u4eec\u5efa\u8bae\uff0c\u53ea\u8981\u6709\u53ef\u80fd\uff0c\u60a8\u5c31\u53ef\u4ee5\u4f7f\u7528\u7531Red Hat\u63d0\u4f9b\u7684CVSS\u57fa\u7840\u5206\u6570\uff0c\u800c\u4e0d\u662f\u4ece\u7b2c\u4e09\u65b9\u83b7\u5f97\u7684\u5206\u6570\u3002<\/strong><\/span>\u5982\u679c\u60a8\u8ba4\u4e3a\u6211\u4eec\u7ed9\u4e00\u4e2a\u7279\u6b8a\u7684\u6f0f\u6d1e\u63d0\u4f9b\u4e86\u9519\u8bef\u7684CVSS v3\u57fa\u7840\u5206\u6570\uff0c\u8bf7\u544a\u8bc9\u6211\u4eec\u3002\u6211\u4eec\u5f88\u9ad8\u5174\u8ba8\u8bba\u95ee\u9898\u7684\u4e25\u91cd\u6027\uff0c\u5e76\u5728\u9700\u8981\u7684\u60c5\u51b5\u4e0b\u8fdb\u884c\u66f4\u65b0\u3002<\/p>\n<h5>\u53c2\u8003\u94fe\u63a5\uff1a<\/h5>\n<ul>\n<li><a href=\"https:\/\/access.redhat.com\/security\/updates\/classification\/\">https:\/\/access.redhat.com\/security\/updates\/classification\/<\/a><\/li>\n<li><a href=\"https:\/\/www.redhat.com\/security\/data\/cve\/\">https:\/\/www.redhat.com\/security\/data\/cve\/<\/a><\/li>\n<li><a href=\"http:\/\/www.redhat.com\/security\/data\/metrics\/\">http:\/\/www.redhat.com\/security\/data\/metrics\/<\/a><\/li>\n<\/ul>\n<p>=END=<\/p>\n","protected":false},"excerpt":{"rendered":"<p>=Start= \u7f18\u7531\uff1a NVD\u548cRedHat\u5bf9 CVE-2017-8890 \u6f0f\u6d1e\u7684\u8bc4\u5206\u5dee\u5f02\uff1a NVD\u7ed9\u51fa\u7684 B [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[23,25,12],"tags":[454,828,831,830],"class_list":["post-3370","post","type-post","status-publish","format-standard","hentry","category-knowledgebase-2","category-security","category-tools","tag-cve","tag-cvss","tag-nvd","tag-redhat"],"views":6379,"_links":{"self":[{"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/posts\/3370","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/comments?post=3370"}],"version-history":[{"count":2,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/posts\/3370\/revisions"}],"predecessor-version":[{"id":3377,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/posts\/3370\/revisions\/3377"}],"wp:attachment":[{"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/media?parent=3370"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/categories?post=3370"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/tags?post=3370"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}