The definition With the introductions and caveats out of the way, we're finally ready to look at the definition. Now let's flesh out exactly what the definition means. In the discussion that follows, we list critical phrases and words from the definition, discuss exactly what we mean by each, and give examples of how the definition could be applied to real-life cases. The choice to implement a 40-bit cipher in a product would not constitute a security vulnerability, even though the protection it provides would be inadequate for some purposes. In contrast, an implementation error that inadvertently caused a 128-bit cipher to discard half the bits in the key would be a security vulnerability.
Security vulnerabilities are a result of a problem in a product.
Problems that result from adhering to imperfect but widely accepted standards are not security vulnerabilities. A browser that, when connecting to an FTP site, conducts the session in plaintext would not be considered to have a security vulnerability, since the FTP specification calls for plaintext sessions. However, if the browser conducted SSL sessions in plaintext, it would constitute a security vulnerability since the SSL specification calls for encrypted sessions. That is, in order for a flaw to constitute a security vulnerability, it must be possible for an attacker to compel the victim to submit to the attack despite reasonable efforts to avoid it. If the user were able to resume normal operation by stopping the browser, restarting it, and avoiding the attacker's web site in the future, the flaw would not constitute a security vulnerability.