Computer Incident Response and Product Security

Chapter 13. Vulnerability Coordination

Although it might not look like it, vendors are getting better at removing vulnerabilities from their products. Through a combination of better product design and more comprehensive testing, vendors are removing many vulnerabilities from their products before they are shipped. What is on the rise are vulnerabilities found in protocols, as demonstrated with vulnerabilities in TCP (in 2001, 2004, and 2009), DNS (2008), and TLS (2009). Because of their nature, vulnerabilities in protocols affect many vendors, so the industry needs to cooperate more closely when dealing with such vulnerabilities. A similar situation arises with vulnerabilities in widely used applications and libraries such as the ones from ...