GB/T 33561-2017Information security technology -- Vulnerabilities classification (English PDF)

5.1 Principles

The classification of security vulnerabilities shall be subjected to the following

principles.

a) uniqueness principle. when a security vulnerability is differentiated in accordance

with properties and characteristics, a vulnerability only belongs to some category

but not belongs to two or more categories.

b) extensibility principle. the category in which security vulnerabilities may be

extensible based on actual conditions.

5.2 Classification

5.2.1 Classification in accordance with causes

Security vulnerabilities may be classified into the following categories in accordance

with the causes.

a) boundary condition errors. security vulnerabilities caused by the failure to control

the operating range during the program run, such as buffer heap overflow, buffer

stack overflow, buffer cross-border operation and format string processing;

systems;

c) the network layer. the vulnerabilities of the network layer mainly come from the

network, such as network layer identity authentication, network resource access

control, data transmission confidentiality and completeness, remote access

security, domain name system security and routing system security.

5.2.3 Classification in accordance with time

5.2.3.1 Generation stage

The computer information system introduces defects or errors during analysis and

design, development, and configuration, operation and maintenance; the existing

problems generate security vulnerabilities during implementation; they can be

classified into the following categories.

a) the analysis and design. security vulnerabilities caused by the factors, including

the quotation of insecure objects, emphasis of ease of use and functions and

performances to compromise security, because of the lack of risk analysis during

the demand analysis and design process of the computer information system;

b) the development. security vulnerabilities caused by intentional or unintentional

defects introduced by the developers in the technical realization during the

development process of the computer information system;

c) the configuration, operation and maintenance. security vulnerabilities caused by

the factors, including improper processing of the interrelations, configurations

and structures of the computer information system by the personnel of operation

and maintenance during the process of operation and maintenance of the

computer information system.

5.2.3.2 Discovery stage

Security vulnerabilities are identified by the vulnerability discoverers, users or

manufacturers for the first time, and may be classified into the following categories.

a) the unconfirmed. security vulnerabilities are discovered for the first time, failing

to give vulnerability data and proofs for the confirmation of vulnerability causes

and hazards;

b) the to-be-confirmed. security vulnerabilities are reported by their discoverer to

manufacturers or vulnerabilities management organizations, having vulnerability

analysis reports or scenarios in which vulnerabilities can be recurred.

c) the confirmed. security vulnerabilities confirmed or issued by vulnerability

discoverers, users or manufacturers, having relevant information including

identification and description.

5.2.3.3 Utilization stage

......