A Critical Analysis of Vulnerability Taxonomies

Abstract : Computer vulnerabilities seem to be omnipresent. In every system fielded programming errors configuration errors and operation errors have allowed unauthorized users to enter systems or authorized users to take unauthorized actions. Efforts to eliminate the flaws have failed miserably; indeed sometimes attempts to patch a vulnerability have increased the danger. Further designers and implementers rarely learn from the mistakes of others in part because these security holes are so rarely documented in the open literature.