Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Facebook Announces Vulnerability Reporting and Disclosure Policy

Facebook is giving third-party application developers three weeks to respond to vulnerability reports and three months to patch bugs before public disclosure. 

Facebook is giving third-party application developers three weeks to respond to vulnerability reports and three months to patch bugs before public disclosure. 

The social media giant took the wraps off a Vulnerability Disclosure Policy this week, aimed at bugs its researchers may discover in third-party code and systems, open source applications included. 

The purpose of the policy, Facebook says, is to make sure that the identified issues are addressed as fast as possible and that the impacted people are informed on the matter, so they can patch their systems to stay protected. 

The social platform also notes that high-impact security flaws will receive more care before public disclosure, and that its researchers will work closely with application developers to aid with the fixing process whenever needed. 

“We expect the third party to respond within 21 days to let us know how the issue is being mitigated to protect the impacted people. If we don’t hear back within 21 days after reporting, Facebook reserves the right to disclose the vulnerability. If within 90 days after reporting there is no fix or update indicating the issue is being addressed in a reasonable manner, Facebook will disclose the vulnerability,” the company says

Facebook also reveals that, should it determine that disclosing a vulnerability prior to the established timeframe would benefit the public, it may do so. 

As part of the responsible disclosure process, Facebook will make a reasonable effort to contact the impacted third-party and will provide them with the information required to understand the reported problem. Additional information will be delivered if needed. 

“If we do not receive a response within 21 days from a contact acknowledging the report of a vulnerability, we will assume that no action will be taken. We then reserve the right to disclose the issue,” Facebook says. The sending of the report is considered to be the beginning of the timeframe. 

Advertisement. Scroll to continue reading.

The company says it is willing to work with the third-party on fixes, but expects transparency on the mitigation progress. The third-party is expected to address the reported vulnerability within 90 days and, if no mitigating circumstances are identified, Facebook will disclose the issue publicly as soon as it can. 

Facebook’s Vulnerability Disclosure Policy also details disclosure paths, as well as potential scenarios when the company will deviate from the 90-day patch requirement, such as active exploitation of the identified security flaw or unnecessary delays on deploying a fix. 

“We will strive to be as consistent as possible in our application of this policy. Nothing in this policy is intended to supersede other agreements that may be in place between Facebook and the third party, such as our Facebook Platform policies or contractual obligations,” the social platform says. 

Facebook also introduced WhatsApp Security Advisories this week, a resource designed to increase transparency through providing information on all of the vulnerabilities that have been addressed in the messaging service and applications. 

“Due to the policies and practices of app stores, we cannot always list security advisories within app release notes. This advisory page provides a comprehensive list of WhatsApp security updates and associated Common Vulnerabilities and Exposures (CVE). Please note that the details included in CVE descriptions are meant to help researchers understand technical scenarios and does not imply users were impacted in this manner,” the company says.

Additionally, Facebook says it will notify developers of third-party libraries and providers of mobile operating systems when security issues that impact their code is discovered. 

Related: Google Project Zero Updates Vulnerability Disclosure Policy

Related: Zero-day Vulnerability Highlights the Responsible Disclosure Dilemma

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

Vulnerabilities

A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.

Vulnerabilities

Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.

Vulnerabilities

The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.