/home/pvrabec/tmp/openscap/openscap-0.1.4/src/CVSS/cvsscalc.h File Reference

Interface to Common Vulnerability Scoring System Version 2. More...

Go to the source code of this file.

Enumerations

enum  AccessVector_t { AV_LOCAL, AV_ADJACENT_NETWORK, AV_NETWORK }
 Access Vector. More...
enum  AccessComplexity_t { AC_HIGH, AC_MEDIUM, AC_LOW }
 Access Complexity. More...
enum  Authentication_t { AU_NONE, AU_SINGLE_INSTANCE, AU_MULTIPLE_INSTANCE }
 Authentication. More...
enum  ConfImpact_t { CI_NONE, CI_PARTIAL, CI_COMPLETE }
 Confidentiality Impact. More...
enum  IntegImpact_t { II_NONE, II_PARTIAL, II_COMPLETE }
 Integrity Impact. More...
enum  AvailImpact_t { AI_NONE, AI_PARTIAL, AI_COMPLETE }
 Availability Impact. More...
enum  Exploitability_t {
  EX_UNPROVEN, EX_PROOF_OF_CONCEPT, EX_FUNCTIONAL, EX_HIGH,
  EX_NOT_DEFINED
}
 Exploitability. More...
enum  RemediationLevel_t {
  RL_OFFICIAL_FIX, RL_TEMPORARY_FIX, RL_WORKAROUND, RL_UNAVAILABLE,
  RL_NOT_DEFINED
}
 Remediation Level. More...
enum  ReportConfidence_t { RC_UNCONFIRMED, RC_UNCORROBORATED, RC_CONFIRMED, RC_NOT_DEFINED }
 Report Confidence. More...
enum  CollateralDamagePotential_t {
  CD_NONE, CD_LOW, CD_LOW_MEDIUM, CD_MEDIUM_HIGH,
  CD_HIGH, CD_NOT_DEFINED
}
 Collateral Damage Potential. More...
enum  TargetDistribution_t {
  TD_NONE, TD_LOW, TD_MEDIUM, TD_HIGH,
  TD_NOT_DEFINED
}
 Target Distribution. More...
enum  ConfReq_t { CR_LOW, CR_MEDIUM, CR_HIGH, CR_NOT_DEFINED }
 Confidentiality Requirement. More...
enum  IntegReq_t { IR_LOW, IR_MEDIUM, IR_HIGH, IR_NOT_DEFINED }
 Integrity Requirement. More...
enum  AvailReq_t { AR_LOW, AR_MEDIUM, AR_HIGH, AR_NOT_DEFINED }
 Availabublity Requirement. More...

Functions

int baseScore (AccessVector_t ave, AccessComplexity_t ace, Authentication_t aue, ConfImpact_t cie, IntegImpact_t iie, AvailImpact_t aie, double *base_score, double *impact_score, double *exploitability_score)
int tempScore (Exploitability_t exe, RemediationLevel_t rle, ReportConfidence_t rce, double base_score, double *temporal_score)
int envScore (CollateralDamagePotential_t cde, TargetDistribution_t tde, ConfReq_t cre, IntegReq_t ire, AvailReq_t are, double *enviromental_score, AccessVector_t ave, AccessComplexity_t ace, Authentication_t aue, ConfImpact_t cie, IntegImpact_t iie, AvailImpact_t aie, Exploitability_t exe, RemediationLevel_t rle, ReportConfidence_t rce)


Detailed Description

Interface to Common Vulnerability Scoring System Version 2.

See details at http://nvd.nist.gov/cvss.cfm


Enumeration Type Documentation

Access Complexity.

This metric measures the complexity of the attack required to exploit the vulnerability once an attacker has gained access to the target system.

Access Vector.

This metric reflects how the vulnerability is exploited.

Enumerator:
AV_LOCAL  requires local access
AV_ADJACENT_NETWORK  adjacent network accessible
AV_NETWORK  network accessible

Authentication.

This metric measures the complexity of the attack required to exploit the vulnerability once an attacker has gained access to the target system.

Enumerator:
AU_NONE  requires multiple authentication instances
AU_SINGLE_INSTANCE  requires single instance of authentication
AU_MULTIPLE_INSTANCE  requires no authentication

Availability Impact.

This metric measures the impact to availability of a successfully exploited vulnerability.

enum AvailReq_t

Availabublity Requirement.

This metric enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user’s organization, measured in term of availability.

Collateral Damage Potential.

This metric measures the potential for loss of life or physical assets through damage or theft of property or equipment.

Confidentiality Impact.

This metric measures the impact on confidentiality of a successfully exploited vulnerability.

enum ConfReq_t

Confidentiality Requirement.

This metric enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user’s organization, measured in term of confidentiality.

Exploitability.

This metric measures the current state of exploit techniques or code availability.

Integrity Impact.

This metric measures the impact to integrity of a successfully exploited vulnerability.

enum IntegReq_t

Integrity Requirement.

This metric enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user’s organization, measured in term of integrity.

Remediation Level.

The remediation level of a vulnerability is an important factor for prioritization.

Report Confidence.

This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details.

Target Distribution.

This metric measures the proportion of vulnerable systems. It is meant as an environment-specific indicator in order to approximate the percentage of systems that could be affected by the vulnerability.


Generated on Sun Mar 29 13:29:21 2009 for Open SCAP Library by  doxygen 1.5.6