The Open Source Vulnerability Database (OSVDB), a project to catalog and describe the world’s security vulnerabilities, has had a challenging yet successful year. The project is fortunate to have the continued support of some devoted volunteers, yet remains challenged to keep up with the increasing number of vulnerability reports, as well as work on the back-log of historical information. Volunteers are continually sought to help us achieve our short and long-term goals.
Despite resource constraints, there have been many exciting successes in 2005:
- A major project goal of obtaining 501(c)3 non-profit status from the U.S. IRS was achieved. Obtaining non-profit status was critical to the long-term viability of the project. This status allows OSVDB to take charitable donations to help cover operating expenses, while providing a tax benefit to donor companies and individuals.
- The vulnerability database has grown to over 22,000 entries thanks to the dedicated work of Brian Martin, OSVDB Content Manager. At the end of December, over 10,000 of those vulnerabilities were worked on by volunteers to provide more detailed and cross-referenced information. Our volunteer “Data Manglers” and Brian have helped ensure OSVDB is the most complete resource for vulnerability information on the Internet.
- OSVDB started a blog in April, as a way for us to keep the public better informed on the project’s status. Very quickly we realized the blog was a perfect place to discuss and comment on various aspects of vulnerabilities, and has become a successful mechanism for communicating with the security industry. If you have suggestions for topics, or would like to join the discussion, please visit the OSVDB blog.
We would like to also recognize our sponsors and thank them for their support. Digital Defense, Churchill & Harriman, Audit My PC, and Opengear have all provided important resources to OSVDB over the past year. We would also like to thank Renaud Deraison of the Nessus Project and HD Moore of the Metasploit Project for their support. Lastly, we of course want to thank our volunteers, and note that several of them have contributed to Nessus Network Auditing, available from Syngress Publishing.
We are very pleased with the progress and growth of OSVDB over the past year, but do not want to downplay the importance of recruiting new volunteers, as well as retaining our current ones, in order to get through the considerable back-log of vulnerabilities that need further work. This task is daunting, but will not only help retain valuable historical vulnerability information, but will also allow OSVDB to generate meaningful statistics for past and current years.
We have had a great year, and are looking forward to another one! We are of course still seeking assistance to help keep OSVDB successful–the project has many ideas in need of financial and volunteer support to implement. For more information on supporting OSVDB through volunteering or sponsorship, please contact email@example.com.
Some people have voiced concerns recently around the readiness and licensing of OSVDB. Although, one may question the motives we feel it is important to acknowledge and address the issues raised as they are valid concerns.
It is critical to understand that the current OSVDB web site is a beta “service”. Until March of 2004, it will undergo a lot of changes, the most noticeable being database population. In the coming months, there will be more fields associated with each vulnerability to further enhance the database and provide the relevant information needed. Even though all entries in the database are not in stable status it is possible to view all entries at this point.
One of the biggest tasks outstanding for OSVDB is refining the current licensing agreement. OSVDB is meant to be free to the information security community and needs to be properly licensed to ensure there are no legal issues for contributors to the project. However, there is one major concern that is still an unresolved issue. OSVDB does not want to have members of the security community volunteer their time, create an incredible database and then have the next commercial scanner come along and use the database to feed their scanning engine without supporting the project. If you have read the current terms of service you will see that it is not worded appropriately as this point but it on the list of things to be addressed.
OSVDB is not a company. While we have Digital Defense currently providing hardware and bandwidth support, they do not own the database. Furthermore, since the project is meant for the open source community, anyone can download the entire database at any time and manipulate it as they see fit. This is something you won’t find with any other public or private vulnerability database.
If you have concerns about the licensing of OSVDB please send your concerns and suggestions to firstname.lastname@example.org.