I think a more useful rating would be "how hard is this bug to exploit?",
which could range from almost impossible (e.g. ssh v1 CRC32 checksum exploit)
to trivial (e.g. script kiddie exploit avialable). I know it would change over
time, but it might give us some indication of the ETA for an exploit for the
script kiddies.

Another measure that might be worth something is the level of tools required
to find and exploit the bug. Plain AAAA....x10000 in obvious places suggests
more problems than mishandling well crafted invalid HTTP requests.

Specially crafting your own word document to apply a buffer overrun exploit
rates as quite hard IMHO. Factors that would boost the difficult rating would
include requiring a valid user name and passowrd. (It is often easy to kick
the backsides of those with a valid user name and password.)

While it might be possible to write a web server with A1 (formally verified)
security, I suspect the cost would be prohibitive and benefit small if the
underlying OS is less secure. The formal methods I know do not scale to
anything of a significant size[*].

Just my $0.03

[*] I have a PhD thesis featuring some of these methods (including a CSP
anmlaysis of any network of the specified components). Related software and a
copies are publically avialable.
--
Duncan (-:
"software industry, the: unique industry where selling substandard goods is
legal and you can charge extra for fixing the problems."

[ reply ]