Security Severity Ratings/Merge: Difference between revisions

From MozillaWiki
Jump to navigation Jump to search
 
(4 intermediate revisions by one other user not shown)
Line 1: Line 1:
{{TOC right}}
{{TOC right}}
Security bugs are rated by specifying "sec-<rating>" in the "Keyword" field in bugzilla.  For example, a bug with a Critical security rating would be marked as "sec-critical".
==unconverted bugs==
* [https://bugzil.la/UNCONFIRMED%2CNEW%2CASSIGNED%2CREOPENED%2Bsw%3A%22%5Bsg%3Adupe%22 sg:dupe]
** whiteboard: [sg:dupe


==Severity Ratings ==
* [https://bugzil.la/UNCONFIRMED%2CNEW%2CASSIGNED%2CREOPENED%2B-kw%3A%22sec-%22%2Bsw%3A%22%5Bsg%3A%22%7Csw%3A%22%5Bws%3A%22 sg or ws NO sec-]
{| class="wikitable collapsible collapsed" style="width: 100%"
** whiteboard: [sg: OR [ws:
! Severity Ratings & Examples
** keywords: (does not contain) sec-
|-
|
The following items are keywords for the severity of an issue.
 
;'''sec-critical''': Exploitable vulnerabilities which can lead to the widespread compromise of many users.
 
''Examples:''
* Overflows resulting in native code execution
* JavaScript injection into browser chrome
* Launching of arbitrary local application with provided arguments
* Filetype spoofing where executables can masquerade as benign content types
* Installation & execution of plugins/modules with chrome/native privileges, without user consent or via user dialog fatigue
* Any crash where random memory or NULL is executed (the top of the stack is not a function)
* Any crash where random memory is accessed
* Any bug where random memory is written to is critical
* Any bug where random memory is read from and then used in a subsequent memory or jump operation (offset, array, etc)  is critical
** XSS (Stored)
** CSRF
** Code Injection
** Authentication Flaws (which lead to account compromise)
** Session Management Flaws (which lead to account compromise)
 
;'''sec-high''': Obtain confidential data from other sites the user is visiting or the local machine, or inject data or code into those sites, requiring no more than normal browsing actions. Indefinite DoS of the user's system, requiring OS reinstallation or extensive cleanup. Exploitable web vulnerabilities that can lead to the targeted compromise of a small number of users.
 
''Examples:''
* Cross-site Scripting (XSS)
* Theft of arbitrary files from local system
* Spoofing of full URL bar or bypass of SSL integrity checks
* Memory read that results in data being written into an inert container (ie string or image) that is subsequently accessible to content
* XSS (Reflected)
*Failure to use TLS where needed to ensure confidential/security
 
;'''sec-moderate''':  Vulnerabilities which can provide an attacker additional information or positioning that could be used in combination with other vulnerabilities. Disclosure of sensitive information that represents a violation of privacy but by itself does not expose the user or organization to immediate risk. The vulnerability combined with another moderate vulnerability could result in an attack of high or critical severity (aka stepping stone). Indefinite application Denial of Service (DoS) via corruption of state, requiring application re-installation or temporary DoS of the user's system, requiring reboot. The lack of standard defense in depth techniques and security controls.
 
''Examples:''
* Disclosure of OS username
* Disclosure of browser cache salt
* Disclosure of entire browsing history
* Detection of arbitrary local files
* Launching of arbitrary local application without arguments
* Local storage of passwords in unencrypted form
* Persistent DoS attacks that prevent the user from starting Firefox or another application in the future
* Missing Additional Security Controls (x-frame options, SECURE/HTTPOnly flags, etc)
* Error Handling Issues
 
;'''sec-low''': Minor security vulnerabilities such as leaks or spoofs of non-sensitive information. Missing best practice security controls
 
''Examples:''
* Detection of previous visit to a specific site
* Identification of users by profiling browsing behavior.
* Corruption of chrome dialogs or user input without the ability to spoof arbitrary messages
* Lack of proper input validation (not resulting in XSS or injection)
* Content spoofing (non-html)
 
;'''sec-other''': Bugs that may not be exploitable security issues but are kept confidential to protect sensitive information. Bugs that contain sensitive information about the bug submitter or another user Bugs that are related to security issues currently unfixed in Mozilla products or other products
 
''Examples:''
* Flaws we need to track that are not in our code base
 
;'''Mitigating Circumstances''':
If there are mitigating circumstances that severely reduce the effectiveness of the exploit, then the exploit could be reduced by one level of severity.  Examples of mitigating circumstances include difficulty in reproducing due to very specific timing or load order requirements, complex or unusual set of actions the user would have to take beyond normal browsing behaviors, or unusual software configuration. 
 
As a rough guide, to be considered for reduction in severity an exploit should  execute successfully less than 10% of the time.  If measures can be taken to improve the reliability of the exploit to over 10% (by combining it with other existing bugs or techniques), then it should not be considered to be mitigated.
 
 
|}
 
==Additional Security Status Codes==
If a potential security issue has not yet been assigned a severity rating, or a rating is not appropriate, the whiteboard may instead contain one of the following security status codes.
{| style="width: 800px;" class="wikitable collapsible collapsed fullwidth-table"
! Shared Keywords
|-
! style="width:5%" | Code
! style="width:10%"| Description
! style="width:5%" | Examples
|-
|<b>sec-audit</b>
|Bug requires a code audit to investigate potential security problems.
|Look for pattern x in library y
Audit file z for string buffer abuse.
|-
|<b>sec-vector</b>
|Flaws in software not controlled by (shipped with) Firefox, but that can cause security problems for people browsing with Firefox.
|Bugs in plugins
Bugs in system libraries used by Firefox
|-
|<b>sec-want</b>
|New features or improvement ideas related to security
|User interface refinements
Support for new types of authentication
 
Code refactoring / cleanup
|-
|<b>sec-incident</b>
| Issues resulting in an incident response or 'chemspill' actions by the security team.
| Sever compromise
Code issues that would cause client code to be respun.
|-
|<b>sec-review-needed</b>
|A security review is needed for the bug, this could mean a variety of things. If there is no secr:<username> in the whiteboard the item has not been triaged and action is unknown. Once triaged a note will be placed in the bug as to the action to be taken
|
|-
|<b>sec-review-complete</b>
|The security review / actions desired have been completed. This will result in either a link to the notes from security actions or a note from the assigned resource in the bug.
|
|-
|}
{| style="width: 800px;" class="wikitable collapsible collapsed fullwidth-table"
! Group Keywords
|-
! style="width:5%" | Code
! style="width:10%"| Description
! style="width:5%" | Examples
|-
| <b>csec- </b>
| Client Security (ie. Firefox, Thunderbird, etc)
|
{|class="wikitable collapsible collapsed fullwidth-table"
! csec-
|-
! style="width:5%" | Code
! style="width:10%"| Description
|-
| csec-buffer-overrun
| The identified flaw is a buffer overrun
|-
|}
|-
| <b>wsec- </b>
| Web Security (Web Sites, Web Services, etc)
|
{|class="wikitable collapsible collapsed fullwidth-table"
! wsec-
|-
! style="width:5%" | Code
! style="width:10%"| Description
|-
| wsec-xss
| The identified flaw is cross site scripting flaw
|-
|}
|-
| <b>opsec- </b>
| Operations Security (Mozilla owned & operated severs and services)
|
{|class="wikitable collapsible collapsed fullwidth-table"
! opsec-
|-
! style="width:5%" | Code
! style="width:10%"| Description
|-
| opsec-access
| The identified issue is an access violation.
|-
|}
|}
{| style="width: 800px;" class="wikitable collapsible collapsed fullwidth-table"
! Whiteboard Tags
|-
! style="width:5%" | Code
! style="width:10%"| Description
! style="width:5%" | Examples
|-
|<b>sec-assigned:UserAlias</b>
|This designates the assigned security resource that is accountable for actions to be taken on the designated item. When possible the bug will be assigned to the security contact for action. This will be used when that is not possible or practical.
|[sg-assigned:curtisk] indicates that curtisk is the accountable party for action
|-
|-
|}
{| style="width: 800px;" class="wikitable collapsible collapsed fullwidth-table"
! Feature Page Codes
|-
! style="width:5%" | Code
! style="width:10%"| Description
! style="width:5%" | Examples
|-
|<b>sec-review-needed</b>
|A security review is needed for the feature, this could mean a variety of things. If there is no <username> in the notes then a full review needs to be scheduled, if a <username> is present than that person will follow-up with the feature team on whatever task is needed.
|
|-
|<b>sec-review-complete</b>
|The security review / actions desired have been completed. This will result in a link to the notes from security actions or a note from the assigned resource.
|
|-
|<b>sec-review-active</b>
| There are active tasks associated with the review that are yet to be completed in order for the review to be seen as completed. These will be captured in the "Action Items" section of the review notes.
|
|-
|<b>sec-review-sched</b>
| Security review tasks have been scheduled, if this is a full security review the date of the scheduled review will be present in the security notes.
|
|-
|<b>sec-review-unnecessary</b>
| After triage it was felt the feature needed no review or security actions.
|
|-
| <b>Security health: <blank></b>
| There are no notes or status is unknown.
| Color: <None>
|-
| <b>Security health: OK</b>
| The tasks are on schedule or completed and are considered non-blocking.
| {{StatusHealthy|status=Color: Green}}
|-
| <b>Security health: Blocked</b>
| Some aspect of the security review has given cause to block the feature from further work or landing. The reasons will be listed in the security notes or linked to a larger review outcome for follow-up.
| {{StatusBlocked|status=Color: Yellow}}
|-
| <b>Security health: At Risk</b>
| Some aspect of the security review may cause the feature to be blocked or put the feature at risk of being off schedule.The reasons will be listed in the security notes or linked to a larger review outcome for follow-up.
| {{StatusAtRisk|status=Color: Red}}
|-
| <b>Security health: Assigned</b>
| Security tasks have been assigned to a member of the team to followup. The name of this resource will be in the security notes.
| {{StatusAssigned|status=Color: Teal}}
|-
|}
{| class="wikitable collapsible collapsed" style="width: 100%"
! Priority Matrix (primarily OpSec)
|-
|
;'''Blocker''': Anything which is easily exploitable or reproducible and/or we are seeing active attempts to exploit. Anything which has a high impact to Mozilla should also be considered. This priority flag should communicate that other work is blocked
by this issue and it should be resolved immediatly.
''Examples:''
* SQL injection or Injection Flaws and Remote File Inclusion (RFI)
* Anything which has been publicized as a 0day which falls into the 'Critical' category.
* Flaws being activly used in the wild (chemspill?).
 
;'''Critical''': Vulnerabilities which are exploitable and/or hard to reproduce. We are also not seeing these being actively exploited or have another means to protect against a vulnerability.
''Examples:''
* XSS
* CSRF and Authentication or token handling issues
:'''Major''': Vulnerabilities which have a slightly less degree of impact compared to Critical.
''Examples:''
* Content Spoofing
* Information Disclosure or Error Handling
;'''Normal''': Internal vulnerability with a low likelihood of being remotely exploitable.
|}


==Transition Plan==
==Transition Plan==
Line 252: Line 16:
|-
|-
| Securitywiki:Open sg:critical/high bugs (ordered by modification date)
| Securitywiki:Open sg:critical/high bugs (ordered by modification date)
| No
| {{done|}}
|-
|-
| Securitywiki:Open sg:critical bugs
| Securitywiki:Open sg:critical bugs
| No
| {{done|}}
|-
|-
| Securitywiki:Open sg:high bugs  
| Securitywiki:Open sg:high bugs  
| No
| {{done|}}
|-
| Securitywiki:Open Firefox 12 critical bugs
| No
|-
|-
| Securitywiki:Open Firefox 13 critical bugs
| Securitywiki:Open Firefox 13 critical bugs
| No
| {{done|}}
|-
|-
| Securitywiki:Open Firefox 14 critical bugs  
| Securitywiki:Open Firefox 14 critical bugs  
| No
| {{done|}}
|-
|-
| Securitywiki: sg:critical bugs not triaged for 12 & 13
| Securitywiki:Open Firefox 15 critical bugs
| No
| {{done|}}
|-
|-
| Securitywiki:sg:critical bugs not triaged for 13 & 14  
| Securitywiki: sg:critical bugs not triaged for 13 & 14
| No
| {{done|}}
|-
| Securitywiki:sg:critical bugs not triaged for 14 & 15
| {{done|}}
|-
|-
| Securitywiki:New, untriaged security-sensitive bugs
| Securitywiki:New, untriaged security-sensitive bugs
| No
| {{done|}}
|-
|-
| Securitywiki:recently fixed (3m) high/critical not triaged for 10/
| Securitywiki:recently fixed (3m) high/critical not triaged for 10/
| No
| {{done|}}
|-
|-
| Securitywiki:recently fixed (6w) untriaged security bugs  
| Securitywiki:recently fixed (6w) untriaged security bugs  
| No
| {{done|}}
|-
|-
| Securitywiki:need info  
| Securitywiki:need info  
| No
| N/A
|-
| Securitywiki:Firefox 5 triage, critical and high bugs that
| No
|-
| Securitywiki:[Need blocking triage]
| No
|-
| Securitywiki:[Block]
| No
|-
|-
| Securitywiki:[Don't block]
| Securitywiki:untriaged security bugs, all products
| No
| {{done|}}
|-
|-
| Securitywiki:security closed bugs with no sg: markings
| Securitywiki:Unresolved hidden client security bugs
| No
| {{done|}}
|-
|-
| Securitywiki:Unresolved hidden bugs with or without sg: whiteboard markers
| Securitywiki:Unresolved hidden web security bugs
| No
| {{done|}}
|-
|-
| Securitywiki:Security Bug crashes in need of triage
| Securitywiki:Security Bug crashes in need of triage
| No
| {{done|}}
|-
|-
| Securitywiki:fuzz testing bugs filed and fixed
| Securitywiki:fuzz testing bugs filed and fixed
| No
| N/A
|-
|-
| Securitywiki:fuzz testing bugs still open
| Securitywiki:fuzz testing bugs still open
| No
| N/A
|-
| Securitywiki:Fixed on trunk but un-triaged for branch
| No
|-
| Securitywiki:Fixed on trunk, truly un-triaged for branch
| No
|-
| Securitywiki:(fixed on trunk but not wanted on branch - problem doesn't exist
| No
|-
| Securitywiki:(maybe wanted - baking on the trunk to assess risk
| No
|-
| Securitywiki:definitely wanted on the branch.
| No
|-
| Securitywiki:wanted and fixed on the branch
| No
|-
| Securitywiki:All disclosed bugs
| No
|-
| Securitywiki:Fixed and disclosed security bugs
| No
|-
| Securitywiki:"Historical Fix Rate Info
| No
|-
|-
| Security Radar: Bugs Marked for Review
| Security Radar: Bugs Marked for Review
| No
| {{done|}}
|-  
|-  
| Security Radar: Assigned Security Bugs
| Security Radar: Assigned Security Bugs
| No
| {{done|}}
|-  
|-  
| Security Radar Triage: Sec-Review-Needed Query
| Security Radar Triage: Sec-Review-Needed Query
| No
| {{done|}}
|-
|-
| Security Radar Triage: Assigned Bugs
| Security Radar Triage: Assigned Bugs
| No
| {{done|}}
|-
|-
| Dan's shared "sg:" BMO queries
| Dan's shared "sg:" BMO queries
| No
| {{done|}}
|-
|-
| Dan's BMO charts
| Dan's BMO charts

Latest revision as of 05:39, 3 June 2012

unconverted bugs

Transition Plan

Example Searches

Archive

archive

Retrieved from "https://wiki.mozilla.org/index.php?title=Security_Severity_Ratings/Merge&oldid=437012"