Bugs versus vulnerabilities?

问题:

What, if any, is the difference between a software bug and a software vulnerability?

回答1:

A bug is when a system isn't behaving as it's designed to behave.

A vulnerability is a way of abusing the system (most commonly in a security-related way) - whether that's due to a design fault or an implementation fault. In other words, something can have a vulnerability due to a defective design, even if the implementation of that design is perfect.

回答2:

Vulnerability is a subset of bug.

A bug is any defect in a product.

A vulnerability is bug that manifests as an opportunity for malicious use of the product. Vulnerabilities generally are not that clearly evident, but require ingenuity to be exploited.

回答3:

The two can sometimes overlap, but I'd say a "bug" is a mistake, while a "vulnerability" is, like the name suggests, a weakness.

回答4:

From a programming perspective, I believe there is no difference between a bug and a vulnerability. They are both mistakes in the software.

However, from a security perspective, a vulnerability is a class of bugs that can be manipulated in some fashion by a malicious person.

回答5:

A bug is a failure of your system to meet requirements.

Vulnerability is a subset of bug - it is when your system can be forced into a failure mode that does not meet requirements, usually by (ab)using your system (or something your system relies on) in an unexpected way.

Usually a vulnerability may result in failure to meet a requirement in one or more of these areas:

• confidentiality
• integrity
• availability

or you can combine the last two:

• confidentiality
• reliability (= integrity + availability)

回答6:

In my eyes vulnerabilities are a subset of bugs that enable someone to perform a malicious or harmful operation with your software.

Bugs are just code that does not work properly (how you define properly is subject to opinion).

回答7:

Wikipedia:

In computer security, the term vulnerability is applied to a weakness in a system which allows an attacker to violate the integrity of that system

For example, home computers are vulnerable to physical threats like flood and hand grenades, but they are not considered a "bug". In enterprise environment, these threats are treated with more seriousness if the risk of system shutting down is great enough, maybe for air traffic support or nuclear reactor management.

Business continuity planning/disaster recovery and high availability usually deals with physical threats and failures by redundant hardware and distributing servers to remote locations.

Classification of software defect (or "bug") can be subjective, since it depends on the intent of the software design and requirements. A feature for a given set of audience may be interpreted as a vulnerability to the other if abused. For example, stackoverflow.com now discloses self-closed questions to those with 10k reps. Some may say it is a vulnerability since it violates common expectation of ordinary users (Like I said, it's a subjective call).

回答8:

A bug is the failure of software to meet requirements. I would consider these to be the ideal requirements, so it would make sense to say that there's a bug in the requirements analysis, although that's more debatable.

A vulnerability is a feature, intended or otherwise, that can be exploited maliciously. It is not necessarily a bug, provided that it was deliberate.

To change subjects, it is a vulnerability that my home wireless has a guessable WPA password, but that was a conscious choice, to facilitate use by my guests. That's an example of requirements leading to a vulnerability. If I'd entered a weak password because I didn't know better, that would have been a bug as well as a vulnerability.

回答9:

If you use Bugzilla, anything you need to do something with is a bug ;)