Back
Ensure a proper name for components

Ensure a proper name for components

TIPS Publication date: 2023-07-03

To ensure that a system component matches correctly with a CVE, the vendor, product name, and version tag must be precisely defined. Using incorrect or incomplete information can lead to mismatches, potentially exposing vulnerabilities that are not properly accounted for.

 

Correct vs. Incorrect Component Definitions

For example, if you are using Windows 11 from Microsoft as your operating system on a node, the following component definition is incorrect:

 

        Vendor: Microsoft
        Product: Windows 11
        Version: (missing)

 

Instead, a proper definition should follow the CPE (Common Platform Enumeration) notation:

 

        Vendor: microsoft
        Product: windows_11_21h2
        Version: 10.0.22000.1574

 

Notice the use of underscores in the product name and dot notation for the version tag. Spaces must be avoided.

 

How BaseFortify Helps with Naming Conventions

BaseFortify.eu assists users with naming conventions to make the process easier. For example, using windows_11 as a product name will work, as it is recognized as an alternative name for windows_11_21h2 based on the Canonical Names list.

 

Finding the Correct CPE Notation

To obtain the correct CPE notation for a component, you have two options:

  1. Search the CPE page for a similar component and use its notation as a reference.
  2. Use system commands to generate a CPE-like annotation.

For example, if you are using Windows 10 or Windows 11, execute the following PowerShell command on your node:

 

        Get-CimInstance Win32_OperatingSystem | foreach {Write-Output "cpe:/o:$($_.Caption):$($_.Version):"}
 

This will produce output similar to:

 

        cpe:/o:Microsoft Windows 11 Pro:10.0.19045:

 

The user should then manually adjust the notation for proper formatting:

 

        microsoft windows_11 10.0.19045

 

Altering the PowerShell command can also yield results that are more easily interpreted by BaseFortify.

 

Understanding CPEs and Their Role in CVEs

Common Platform Enumeration (CPE) is a standardized method of identifying software applications, operating systems, and hardware devices. CPEs are essential in vulnerability management as they allow security tools to associate specific system components with known vulnerabilities (CVEs).

A Common Vulnerabilities and Exposures (CVE) entry describes a publicly known cybersecurity vulnerability. To determine whether a system is affected by a CVE, security tools rely on CPEs to match software components with the vulnerabilities listed in the National Vulnerability Database (NVD).

 

Links and Sources