Proposal of RSS Extension
for Security Information Exchange
18th Annual FIRST Conference
2006/06/30

Masato Terada
m-terada@ipa.go.jp
http://jvn.jp/
Copyright © JVN. 2006. All rights reserved.

Opening
We propose JVNRSS (JP Vendor Status Notes RSS) as a security
information sharing and exchanging specification. JVNRSS is basedon RSS 1.0 and uses the “<dc:relation>" field defined in the Dublin
Core as a Relational ID to correlate security information issued byvarious sources. JVNRSS uses the reference URL specified in asecurity alert, for example, an URL of the Common Vulnerability
Exposure, CERT Advisory, CERT Vulnerability Note and CIAC
Bulletin.
In this presentation, firstly we’ll explain the specification andapplications of JVNRSS. Secondly, we'll introduce the result of our
feasibility study on JVNRSS and lastly we'll propose the RSS
Extension for security information sharing.
Copyright © JVN. 2006. All rights reserved.

Contents
1. Vulnerability Information Handling Framework in Japan
2. JVN: JP Vendor Status Notes
3. Proposal of RSS Extension for Security Information Exchange

Copyright © JVN. 2006. All rights reserved.

Vulnerability Information
Handling Framework in Japan

http://jvn.jp/

Copyright © JVN. 2006. All rights reserved.

1.

Vulnerability Information Handling Framework in Japan
Under “the Guideline for Handling Vulnerability-related Information”
Announced on July 7, 2004, into Effect on July 8, 2004

Government-private sector cooperation to promote a smooth information flow concerningvulnerabilities and countermeasures of software products/web site applications. The first
vulnerability information handling mechanism that is based on the official rules.

Expected Effects
1. Promote proactive vulnerability response by vendors/web site operators

1.
vulnerabilityby
1. Promote
Promoteproactive
vulnerability
response
by vendors/web
vendors/web site
site operators
operators
2. Curb proactive
neglect
and improper
publication of response
vulnerability
information
Prevent leakandof sensitive
informationand disruption ofof
critical
systems2.
improperpublication
vulnerability
information
2. Curb
Curb3.neglect
neglect
andimproperpublicationofvulnerability
information
3.
3. Prevent
Prevent leak
leak ofof sensitive
sensitive information
information andand disruption
disruption ofof criticalcritical systems
systems
Copyright © JVN. 2006. All rights reserved.

4

1.

Handling Framework for Vulnerability of Software product The Software Vulnerabilities Handling Framework defines theoperational process for vulnerability information handling from avulnerability’s discovery to its release to the public.


Report a vulnerability to IPA
Coordinate the vulnerability information handling between
JPCERT/CC and JP product vendors
Investigate and eliminate vulnerabilities in the products of each JP
vendorAnnounce security information on JVN

 JPCERT/CC collaborates with CERT/CC and NISCC on
vulnerability information handling in the International framework.

Copyright © JVN. 2006. All rights reserved.

5

1.

Handling Framework for Vulnerability of Software product

Finder

2. Verification

1. Report

Receipt Body
(IPA)

4. Identification of affected
vendors from DB

3. Forward
reportCoordination Body
International
9. Announcement
Framework(JPCERT/CC)
Notification
JP Vendor Status Notes
VN-JP
5. Notification of vulnerability related
information - Test suite and validation process
6. Coordination of announcement date
8. Submission of security
information

End User
Cooperate
Users
SystemIntegrators
ISP
Distributors

7. Investigation andJPmake countermeasuresVendor1
Copyright © JVN. 2006. All rights reserved.

JP
Vendor2

JP
Vendor3
6

1.

Vulnerabilities reported Statistics 2004-2006

Vulnerabilities
120
Vuln. of Software products
100

Vuln. of Web sites

80

73

71

67

102

72

66
56

32
19

36

34

20
06
/1
Q

40

20
05
/4
Q

60

18
13

12

20
04
/4
Q

20
05
/1
Q

20

20
05
/3
Q

20
05
/2
Q

20
04
/3
Q

0

http://www.ipa.go.jp/security/index-e.html
Copyright © JVN. 2006. All rights reserved.

7

JVN: JP Vendor Status Notes

http://jvn.jp/

Copyright © JVN. 2006. All rights reserved.

2.

JVN History

 JVN project started in 2003 to make a portal site of security
information of domestic product vendors in Japan.
2002
2002

2003
2003

2004
2004

2005
2005

2002/06 JVN Project Started
2003/02 jvn.doi.ics.keio.ac.jp Opened to public.
2003/07 JVNRSS channel service Opened to public.
2004/01 TRnotes service Opened to public.

2004/07 jvn.jp Opened to public.
1st Step (Trial Site)
JVN: JPCERT/CC Vendor Status Notes
February 3, 2003
URL
http://jvn.doi.ics.keio.ac.jp
Emailjvn@doi.ics.keio.ac.jp

Copyright © JVN. 2006. All rights reserved.

nd Step
22nd
Step
JVN:
JVN: JPJP Vendor
Vendor Status
Status Notes
Notes
July
July 8,
8, 20042004
URL
http://jvn.jp/
URL
http://jvn.jp/
Emailjvn@jvn.jp
Email
jvn@jvn.jp

9

2.

Overview of JVN

 July 2004, “JP Vendor Status Notes (JVN)” was launched as aportal site to offer security information on domestic productvendors under the vulnerability information handling framework inJapan.


Provide the Vendor Status Notes (VN) and the status Tracking
Notes (TRnotes).
“Vendor Status Notes (VN)” VN is a service providing information
on how to fix vulnerabilities. It is similar to the “CERT Vulnerability
Notes” and follows up the IPA/JPCERT Vulnerability reports, USCERT Alerts, US-CERT Vulnerability Notes and NISCC Advisories.
“Status Tracking Notes (TRnotes)” is a service providing
information on the incidents, specifically what worms do, when the
exploit codes were released and what the countermeasures are.

Copyright © JVN. 2006. All rights reserved.

10

2.

Information Categories at JVN

 “JP Vendor Status Notes (JVN)” has four information categories.




Alert

VN-JP
VN-CERT/CC
VN-NISCC
TRnotes

http://www.ipa.go.jp/
http://www.jpcert.or.jp/

Assigned Identifier
by JVN

IPA, JPCERT/CC AlertNISCC Advisory

VN-NISCC

US-CERT AlertNISCC-xxxxxx
JVNTAxx-xxxx

VN-CERT/CC
NoticeUS-CERT Vulnerability Note
IPA Vulnerability report

Copyright © JVN. 2006. All rights reserved.

JVNVU#xxxxxx

VN-JP

JVN#xxxxxxxx

TRnotes

TRxxxxxx

11

2.

JVN Top page (http://jvn.jp/)

About JVN
2004-07-08: Public Opened
2004-07-20: Workshop of Vulnerability Information Handling

Product Vendor List

Multiple SSL-VPN products fail to set the "Secure" attribute of a cookie
desknet's vulnerable to script execution via certain HTML mail

Related Sites

VN-JP

Virus Baster Cooperate Edition vulnerable to information leakNotified via IPA

Report a Vulnerability

Multiple vulnerabilities in Mozilla products
Microsoft Windows JPEG component buffer overflow
Vulnerabilities in MIT Kerberos 5

VN-CERT/CC

Notified via CERT/CC
Vulnerability Issues with Business Objects WebIntelligence Product
Vulnerability Issues with the Apache Web Server
Vulnerability Issues in MIMEVN-NISCC
Notified via NISCC

Microsoft Windows JPEG component buffer overflow
W32/Novarg.A Virus
Multiple vulnerabilities in Mozilla products

Copyright © JVN. 2006. All rights reserved.

TRnotes12

2.

Vendor Status Notes (VN) “Vendor Status Notes (VN)” includes a list of JP product vendors
who may have been affected by the reported vulnerabilities.


VN has three information categories such as VN-JP, VN-CERT/CC
and VN-NISCC.
Each web page consists of the overview of the problem, its impact,
vendor information and related information.

JVN#12345678
Title
Overview
ImpactVendor Information
Reference
Revisions

Copyright © JVN. 2006. All rights reserved.

Vendor Information includes Vendor Name, Status
and Last Update. There are five categories as
Status.
StatusUnknown
Vulnerable
Vulnerable (Completed investigation)
Vulnerable (Under investigation)
Not Vulnerable
Not Vulnerable (Completed investigation)
Not Vulnerable (Under investigation)
13

2.

Example of Vendor Status Notes (VN)

About JVN

Product Vendor List
Related Sites

Multiple Vulnerabilities in libpng
Ovewview
Several vulnerabilities exist in the libpng library, the most serious of which could allow a
remote attacker to execute arbitrary code on an affected system.

Report a Vulnerability

ImpactA remote attacker could cause an application to crash or potentially execute arbitrarycode by convincing a victim user to visit a malicious web site or view an email message
containing a malformed image.
Vendor Information

Product Vendor List
Vendor Name

Copyright © JVN. 2006. All rights reserved.

StatusFujitsu

Not Vulnerable (Completed investigation)

MIRACLE Linux

Vulnerable (Completed investigation)

Turbo Linux

Vulnerable (Completed investigation)

TechMatrix

Not Vulnerable (Completed investigation)

Last Update

14

2.

Vendor Status Notes (TRnotes)

 “Status Tracking Notes (TRnotes)” includes a list of event/timeinformation on incidents concerning vulnerabilities.
Each web page consists of the overview, timeline concerning avulnerability and related information.
The purpose of TRnotes is in sharing the timeline of the incident,
which includes worm activities, the date exploit codes were released
and the countermeasure against security incidents. The information
is based on public information.
TRxxxxxxx
Title
Overview
Event Information
Reference

Copyright © JVN. 2006. All rights reserved.

Event Information includes followings.

- Date the vulnerability was discvered- Date any advisories are released- Date exploit codes are published- Date worms are produced- Published alerts from governments.
- Additional resources, such as a government
agency
etc.
15

2.

Example of Vendor Status Notes (TRnotes)

About JVN

Product Vendor List
Related Sites

Microsoft Windows JPEG component buffer overflow
Event List
Time (JST)Event Information
Microsoft sent the Japanese Security information of Sep. 2004 by Email.

Report a Vulnerability

ISSKK announces an alert “Microsoft GDI+ JPEG Processing Exploitation”.

Copyright © JVN. 2006. All rights reserved.

16

Proposal of RSS Extension
for Security Information Exchange

http://jvn.jp/

Copyright © JVN. 2006. All rights reserved.

3.

Research motivation

 How we can provide a more efficient security information
distribution service for the security administrators that helps them
reduce their workload related to collecting and grouping various
information and take care of security incidents.

Distribution designed to encouragereusing of information
More efficient aggregation of
information from product vendors

Copyright © JVN. 2006. All rights reserved.

18

3.

JVNRSS (JP Vendor Status Notes RSS) Keywords for the solution
 Semantic Web
 RSS (RDF Site Summary)Format forthe overview

JVNRSS

Title
Overview
Affected System
ImpactSolution
Exploit

Format forthe details

VULDEFandothersReference

Using JVNRSS, an XML format to describe the overview,is an essential point in the security information exchange.
Copyright © JVN. 2006. All rights reserved.

19

3.

JVNRSS Specification

 JVNRSS Summary format for security information exchange.
 Based on RSS 1.0 and use the field <dc:relation> of Dubline
Core as index of grouping security information.
<item rdf:about="URL of security information"><title>Title</title><link>URL of security information</link><dscription>Outline of security information</description><dc:publisher>Product vendor name</dc:publisher><dc:creator>Contact point information</dc:creator><dc:identifier>Security information ID</dc:identifier><dc:relation>Relational ID (1) {CVE|CERT-CA|CERT-VU|etc.}</dc:relation><dc:relation>Relational ID (2) {CVE|CERT-CA|CERT-VU|etc.}</dc:relation><dc:relation>::</dc:relation><dc:date>Date last updated</dc:date><dcterms:issued>Date first published</cterms:issued><dcterms:modified>Date last updated</dcterms:modified></item>Copyright © JVN. 2006. All rights reserved.

20

3.

JVNRSS Example

 ID: JVNVU#834865
 Title: Sendmail contains a race condition

Reference: http://www.us-cert.gov/cas/techalerts/TA06-081A.html
Reference: http://www.kb.cert.org/vuls/id/834865
Reference: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2006-0058<item rdf:about="http://jvn.jp/cert/JVNVU%23834865"><title>Sendmail contains a race condition</title><link>http://jvn.jp/cert/JVNVU%23834865</link><description>A race condition in Sendmail may allow a remote attacker … </description><dc:publisher>JVNRSS-DEV project</dc:publisher><dc:creator>jvn@jvn.jp</dc:creator><dc:identifier>JVNVU#834865</dc:identifier><dc:relation>http://www.us-cert.gov/cas/techalerts/TA06-081A.html</dc:relation><dc:relation>http://www.kb.cert.org/vuls/id/834865</dc:relation><dc:relation>http://cve.mitre.org/cgi-bin/cvename.cgi?name=2006-0058</dc:relation><dc:date>2006-04-03T10:30+09:00</dc:date><dcterms:issued>2006-03-23T04:00+09:00</dcterms:issued><dcterms:modified>2006-04-03T10:30+09:00</dcterms:modified></item>Copyright © JVN. 2006. All rights reserved.

21

3.

JVNRSS Application: Visualized JVNRSS Offer the summary of JVN articles through other websites.

Copyright © JVN. 2006. All rights reserved.

22

3.

JVNRSS Application: Visualized TRnotes

 Arrange all events by time.
<item<item rdf:about="http://www.security-express.com/archives/bugtraq/2005-08/0181.html">
rdf:about="http://www.security-express.com/archives/bugtraq/2005-08/0181.html"><title>[Full-disclosure]<title>[Full-disclosure] (MS05-039)(MS05-039) Microsoft
Microsoft Windows
Windows Plug-and-Play
Plug-and-Play Service
Service Remote
Remote Overflow
Overflow(Universal(Universal Exploit
Exploit ++ nono crashcrash shellcode)</title>
shellcode)</title><link>http://www.security-express.com/archives/bugtraq/2005-08/0181.html</link><link>http://www.security-express.com/archives/bugtraq/2005-08/0181.html</link><dc:relation>http://www.us-cert.gov/cas/techalerts/TA05-221A.html</dc:relation><dc:relation>http://www.us-cert.gov/cas/techalerts/TA05-221A.html</dc:relation><dc:date>2005-08-12T23:37+09:00</dc:date><dc:date>2005-08-12T23:37+09:00</dc:date></item></item>Copyright © JVN. 2006. All rights reserved.

23

3.

JVNRSS Application: Security information gathering system Reduce workload in collecting and grouping security
information.
Vendor A Site
(3) Convert XML to HTMLHTML Hyperlink

JVN Sites
CA-2003-04- Vendor A- Vendor B- News X:

JVNRSSHTMLHTMLJVNRSS

ConvertmoduleHTMLHTML

Gathering
moduleMapping DB
CERT-CACVE etc

ArchiveDB(2) Grouping of the
security information.
Copyright © JVN. 2006. All rights reserved.

<item<item rdf:about="
rdf:about=" http://A.JP/alert-sql.html
http://A.JP/alert-sql.html ">"><title>SQL<title>SQL Slammer
Slammer worm
worm information</title>
information</title><link>http://A.JP/alert-sql.html</link><link>http://A.JP/alert-sql.html</link><dc:relation>CA-2003-04.html</dc:relation><dc:relation>CA-2003-04.html</dc:relation></item></item>(1) Gathering of the security informationJVNRSSGrouping
module<a href=“http://A.JP/alert-sql.html”>
Microsoft SQL Slammer Worm</a>

JVNRSSJVNRSSJVNRSSJVNRSSJVNRSSNews X Site<a href=“http://X.JP/news-sql.html”>
SQL Slammer worm information</a><item<item rdf:about="
rdf:about=" http://X.JP/news-sql.html
http://X.JP/news-sql.html ">"><title>SQL<title>SQL Slammer
Slammer worm
worm information</title>
information</title><link>http://X.JP/news-sql.html</link><link>http://X.JP/news-sql.html</link><dc:relation>CA-2003-04.html</dc:relation><dc:relation>CA-2003-04.html</dc:relation></item></item>24

3.

JVNRSS Application: Proposal grouping (correlation) mechanism

 The grouping mechanism using Relational ID without
mapping DB.
Vendor A Site
(3) Convert XML to HTML<a href=“http://A.JP/alert-sql.html”>
Microsoft SQL Slammer Worm</a>

JVN Sites
CA-2003-04- Vendor A- Vendor B- News X:

CA-2003-04

match

ConvertmoduleGrouping
module(1) Gathering of the security information

YES

Gathering
moduleCA-2003-04
Mapping DB
CERT-CACVE etc<item<item rdf:about="
rdf:about=" http://A.JP/alert-sql.html
http://A.JP/alert-sql.html ">"><title>SQL<title>SQL Slammer
Slammer worm
worm information</title>
information</title><link>http://A.JP/alert-sql.html</link><link>http://A.JP/alert-sql.html</link><dc:relation>CA-2003-04.html</dc:relation><dc:relation>CA-2003-04.html</dc:relation></item></item>ArchiveDB(2) Grouping of the
security information.
Copyright © JVN. 2006. All rights reserved.

News X Site<a href=“http://X.JP/news-sql.html”>
SQL Slammer worm information</a><item<item rdf:about="
rdf:about=" http://X.JP/news-sql.html
http://X.JP/news-sql.html ">"><title>SQL<title>SQL Slammer
Slammer worm
worm information</title>
information</title><link>http://X.JP/news-sql.html</link><link>http://X.JP/news-sql.html</link><dc:relation>CA-2003-04.html</dc:relation><dc:relation>CA-2003-04.html</dc:relation></item></item>25

3.

JVNRSS Application: Proposal grouping (correlation) mechanism

 The grouping mechanism using Relational ID with mappingDB.
(3) Convert XML to HTMLJVN Sites
CA-2003-04- Vendor A- Vendor B- News X:

Mapping DB entryCVE-2004-0230
CVE-2004-0230
TA04-111A
TA04-111A
XF15886
XF15886
VU#415294
VU#415294
BID10183
BID10183

ConvertmoduleGrouping
moduleGathering
moduleMapping DB
CERT-CACVE etc

ArchiveDB

CA-2003-20
CA-2003-20
CIAC
CIAC Bulletin
Bulletin N-133
N-133
JPCERT-AT-2003-0005
JPCERT-AT-2003-0005
JPCERT-AT-2003-0006
JPCERT-AT-2003-0006<item rdf:about="http://VendorA/sec01.html"><title>Vulnerability Issues in TCP</title><link>http://VendorA/sec01.html</link><dc:relation>TA04-111A</dc:relation></item><item rdf:about="http://NewsX/sec99.html"><title>Potential Reliability Issue in TCP</title><link>http://NewsX/sec99.html</link><dc:relation>VU#415294</dc:relation></item>(2) Grouping of the
security information.
Copyright © JVN. 2006. All rights reserved.

26

3.

JVNRSS: Proposal grouping (correlation) mechanism

 The grouping mechanism using Relational ID with mapping
DB.
Vendor A Site
(3) Convert XML to HTML<a href=“http://A.JP/alert-sql.html”>
Microsoft SQL Slammer Worm</a>

JVN Sites
CA-2003-04- Vendor A- Vendor B- News X:<item<item rdf:about="
rdf:about=" http://A.JP/alert-sql.html
http://A.JP/alert-sql.html ">"><title>SQL<title>SQL Slammer
Slammer worm
worm information</title>
information</title><link>http://A.JP/alert-sql.html</link><link>http://A.JP/alert-sql.html</link><dc:relation>415294</dc:relation><dc:relation>415294</dc:relation></item></item>VU#415294

match

Convertmodule(1) Gathering of the security information

YES

Grouping
moduleGathering
module

VU#415294

Mapping DB
CERT-CACVE etc

ArchiveDB

CA-2003-04(2) Grouping of the
security information.
Copyright © JVN. 2006. All rights reserved.

News X Site<a href=“http://X.JP/news-sql.html”>
SQL Slammer worm information</a><item<item rdf:about="
rdf:about=" http://X.JP/news-sql.html
http://X.JP/news-sql.html ">"><title>SQL<title>SQL Slammer
Slammer worm
worm information</title>
information</title><link>http://X.JP/news-sql.html</link><link>http://X.JP/news-sql.html</link><dc:relation>CA-2003-04.html</dc:relation><dc:relation>CA-2003-04.html</dc:relation></item></item>27

3.

JVNRSS practical activity

 CVE+

http://jvnrss.ise.chuo-u.ac.jp/jtg/cve+/

CVE+ is to make a relationship map between CVE and Japanese
security information.

 TRnotes

http://jvnrss.ise.chuo-u.ac.jp/jtg/trn/TRnotes provides HTML based information, JVNRSS format andVisualized TRnotes.

 XSL_swf

http://jvnrss.ise.chuo-u.ac.jp/jtg/xswf/

XSL_swf is FLASH tool for visualized JVNRSS and uses a part of XSL
as a mechanism to describe how the document should be displayed.

 RSS_dir

http://jvnrss.ise.chuo-u.ac.jp/jtg/rssd/

RSS_dir is concept of RSS directory for RSS channel. RSS directory
describes a RSS channel tree with RSS format.

 SIG_rdf
Copyright © JVN. 2006. All rights reserved.

http://jvnrss.ise.chuo-u.ac.jp/jtg/xsig/

28

3.

CVE+

JVNRSS practical activity

 Prototype systemModules: gathering, grouping and convert
Viewer
Java
AppletData Format
TouchGraph Link Browser

TouchGraph
TouchGraphXMLXML

MAP Viewer

JVNRSSJVNRSS<sec:item><sec:item>

SWF

LIST Viewer
SWF

HTML
HTML

Web Browser

Convert module
cve.xml

CVE.mitre.org
nvd.xml

NVD.nist.gov

Grouping
moduleGathering
modulejvnrss.rdf

Mapping
DB

ArchiveDB

jvnrss.rdf

Mapping DB data source
Copyright © JVN. 2006. All rights reserved.

site.Bsite.A

Archive DB data source
29

3.

CVE+

JVNRSS practical activity

 Viewer: TouchGraph Link Browser (Java Applet)

Data Format: TouchGraph XML format<EDGESET><EDGESET><EDGE<EDGE fromID="CVE_2004-0230"
fromID="CVE_2004-0230" toID="CERT_TA04-111A
toID="CERT_TA04-111A "" />/></EDGESET></EDGESET><NODESET><NODESET><NODE<NODE nodeID="CVE_2004-0230">
nodeID="CVE_2004-0230"><NODE_LABEL<NODE_LABEL label="CVElabel="CVE CVE-2004-0230"
CVE-2004-0230" />/></NODE></NODE><NODE<NODE nodeID="CERT_TA04-111A">
nodeID="CERT_TA04-111A"><NODE_LABEL<NODE_LABEL label="US-CERT
label="US-CERT TA04-111A“TA04-111A“ />/></NODE></NODE></NODESET></NODESET>

Copyright © JVN. 2006. All rights reserved.

30

3.

JVNRSS practical activity

CVE+ Viewer: Map Viewer (SWF)

Data Format: TouchGraph XML format<EDGESET><EDGESET><EDGE<EDGE fromID="CVE_2004-0230"
fromID="CVE_2004-0230" toID="CERT_TA04-111A
toID="CERT_TA04-111A "" />/></EDGESET></EDGESET><NODESET><NODESET><NODE<NODE nodeID="CVE_2004-0230">
nodeID="CVE_2004-0230"><NODE_LABEL<NODE_LABEL label="CVElabel="CVE CVE-2004-0230"
CVE-2004-0230" />/></NODE></NODE><NODE<NODE nodeID="CERT_TA04-111A">
nodeID="CERT_TA04-111A"><NODE_LABEL<NODE_LABEL label="US-CERT
label="US-CERT TA04-111A“TA04-111A“ />/></NODE></NODE></NODESET></NODESET>

Copyright © JVN. 2006. All rights reserved.

31

3.

JVNRSS practical activity

CVE+ Viewer: LIST Viewer (SWF)

Data Format: JVNRSS + <sec:item> format<item<item rdf:about="http://www.us-cert.gov/cas/
rdf:about="http://www.us-cert.gov/cas/ …… ">"><title>TA04-111A</title><title>TA04-111A</title><sec:item><sec:item><item<item rdf:about="http://jvn.jp/cert/JVNTA04-111A">
rdf:about="http://jvn.jp/cert/JVNTA04-111A"><title>Potential<title>Potential Reliability
Reliability Issue
Issue inin TCP</title>
TCP</title></item></item><item<item rdf:about="http://www.hitachi.co.jp/…">rdf:about="http://www.hitachi.co.jp/…"><title>GR2000/GR4000/GS4000/GS3000<title>GR2000/GR4000/GS4000/GS3000 …</title>…</title></item></item></sec:item></sec:item></item></item>Copyright © JVN. 2006. All rights reserved.

32

3.

XSL_swf

JVNRSS practical activity

 XSL_swf is a FLASH tool for the visualized JVNRSSXSL_swf refers to an XSL file to describe how a document should
be displayed.

<?xml-stylesheet href="./trn.xsl" type="text/xsl" ?>JVNRSS or RSS<item rdf:about="http://www.trendmicro.co.jp/ ... WORM_ZOTOB.A"><title>Trendmicro: WORM_ZOTOB.A</title><link>http://www.trendmicro.co.jp/ ... WORM_ZOTOB.A</link></item><item rdf:about="http://www.security-express.com/ ... 0181.html"><title>[Full-disclosure] (MS05-039) Microsoft Windows Plug-and-Play ... </title><link>http://www.security-express.com/ ... 0181.html</link></item><xsl:stylesheet version="1.0"

XSL<xsl:when test="rss:link=“'http://www.trendmicro.co.jp/ ... WORM_ZOTOB.A'">
LEVEL1</xsl:when><xsl:when test="rss:link='http://www.security-express.com/ ... 0181.html'">
LEVEL2</xsl:when>
Copyright © JVN. 2006. All rights reserved.

33

3.

RSS_dirJVNRSS practical activity

 RSS_dir is a concept of the RSS directory for the RSS channel.
RSS directory describes a RSS channel tree using the RSS format.
 Check the feed for changes and react to the changes in an
appropriate way
jp_root.rdf
root.rdfroot

jp_root

JP vendor A

vendorA_root.rdf
year2005
year2006

JP vendor B
JP vendor C

Product A
Product B
NEW products

vendorC_root.rdf
Copyright © JVN. 2006. All rights reserved.

34

3.

JVNRSS practical activity

RSS_dir

 Use RSS_dir to selectively display the information collected/updated
in the last 7 days
Step1: Read top layer RDF

jp_root.rdf
JP root

JP vendor A
JP vendor B

vendorA.rdf
vendorB.rdf

Step2: Read 2nd layer RDFs

Updated in the last 7 days

Copyright © JVN. 2006. All rights reserved.

35

3.

Proposal RSS Extension

 JVNRSS is based RSS 1.0 and a proprietary format in Japan.
 Exchange security information in worldwide.
 The ability to use RSS holds the key to successfully implement a
scheme for distributing security related information.
 Qualified Security Advisory Reference (mod_sec)
RSS Extension definition of the tags for RSS 1.0, RSS 2.0
and Atom

Copyright © JVN. 2006. All rights reserved.

36

3.

MOD_SEC: sec:references sec:references is an element for a best reference (CVE, CERT
Advisory, CERT Vulnerability Note, US-CERT Technical Alert etc.)
to related security information.
 Syntax<sec:references sec:source="%name" sec:id="%id">%ResourceReference</sec:references>%name
An attribute is abbreviation name, which provides the best reference,such as CVE, JPCERT, CERT, CIAC, BID, CERT-VN, MS, OSVDB,XF etc.

%id
An attribute is the unique identifier assigned by sec:source, such as
VU#105259, MS01-044, CVE-2001-0525, CA-2001-14, TA05-111A
etc.



%ResourceReference
An entity value is a URI reference to a resource.

Copyright © JVN. 2006. All rights reserved.

37

3.

MOD_SEC: sec:identifier sec:identifier is an element for the unique identifier assigned by
vendor.
 Syntax</sec:identifier>%id</sec:identifier>

%id
An attribute is the unique identifier assigned by vendor, such as"Cisco Security Advisory ID#50960", HPSBMA01234 etc.

Copyright © JVN. 2006. All rights reserved.

38

MOD_SEC: Example
Atom + <sec:identifier> and <sec:references>3.

 ID: JVNTA06-109A
 Title: Oracle Products Contain Multiple Vulnerabilities


Reference: http://www.us-cert.gov/cas/techalerts/TA06-109A.html<entry><title>Oracle Products Contain Multiple Vulnerabilities</title><link rel="alternate" type="text/html" href="http://jvn.jp/cert/JVNTA06-109A/"/><id>http://jvn.jp/cert/JVNTA06-109A/</id><summary type="text">Oracle products and components are affected by multiple
vulnerabilities. </summary><published>2006-04-20T11:30+09:00</published><updated>2006-04-21T15:00+09:00</updated><author><name>JVN</name><email>jvn@jvn.jp</email><uri>http://jvn.jp/</uri></author><sec:identifier>JVNTA06-109A</sec:identifier><sec:references sec:source="CERT" sec:id="TA06-109A">
http://www.us-cert.gov/cas/techalerts/TA06-109A.html</sec:references></entry>
Copyright © JVN. 2006. All rights reserved.

39

Reference
 IPA (Information-technology Promotion Agency, Japan)


http://www.ipa.go.jp/english/about/index.html
http://www.ipa.go.jp/english/security/index.html

 JPCERT/CC

http://www.jpcert.or.jp/english/

 JVN (JP Vendor Status Notes)


http://jvn.jp/ (Japanese)
http://www.ipa.go.jp/english/security/third.html

 JVNRSS (JP Vendor Status Notes RSS) Feasibility Study Site

http://jvnrss.ise.chuo-u.ac.jp/jtg/

Copyright © JVN. 2006. All rights reserved.

Ending
We propose "JVNRSS" to solve the problems and improve thesecurity information exchange for security administrators. JVNRSS isbased on RSS 1.0 and use the field <dc:relation> of Dubline Core asindex of grouping security information. This presentation has
discussed the specification of JVNRSS and the application, especiallythe gathering and grouping approach for the security informationexchange. Furthermore, we introduce RSS extension of security
information exchange.

Copyright © JVN. 2006. All rights reserved.

Thank you
Proposal of RSS Extension
for Security Information Exchange
2006/06/30
Masato Terada
office@jpcert.or.jp
http://jvn.jp/
IPA (Information-technology Promotion Agency, Japan)
JPCERT/CC (Japan Computer Emergency Response Team Coordination Center)

Copyright © JVN. 2006. All rights reserved.