Risk
1/8/2009
07:41 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

25 Most Dangerous Programming Errors Exposed

By publicizing these common programming errors, the participating organizations hope to make software code, and by extension the nation's cyberinfrastructure, more secure.

Experts from more than 30 U.S. and international cybersecurity organizations plan to disclose the 25 most dangerous programming errors on Monday, at a media event in Washington, D.C.

The CWE/SANS Top 25 List was compiled with help from organizations and individuals including Apple, CERT, Microsoft, Oracle, Red Hat, and Symantec, to name a few. It is managed by The SANS Institute and Mitre, and funded by U.S. Department of Homeland Security's National Cyber Security Division and the U.S. National Security Agency, both of which also contributed to the development of the list.

CWE stands for Common Weakness Enumeration, a government-sponsored software assurance initiative.

By publicizing these common programming errors, the participating organizations hope to make software code, and by extension the nation's cyberinfrastructure, more secure. Just two of these errors led to more than 1.5 million security breaches in 2008, according to the groups.

"This activity is an important first step in managing the vulnerability of our networks and technology," said Tony Sager, director of the Vulnerability Analysis Office at the National Security Agency, in a statement. "We need to move away from reacting to thousands of individual vulnerabilities, and focus instead on a relatively small number of software flaws that allow vulnerabilities to occur, each with a general root cause. This allows us to then target improvements in software development practices, tools, and requirements to manage these problems earlier in the life cycle, where we can solve them at large scale and cost-effectively."

The hope is that the errors list will serve four major purposes: To make software more secure for buyers by requiring that vendors certify their software is free of these top 25 errors; to incorporate awareness of these errors into software testing tools; to provide information necessary for educators to teach more secure programming techniques; and to provide a guide for employers to determine the abilities of programmers to write code free of these errors.

"The first two errors on the Top 25 are improper input validation and improper output encoding, and they earned the top rating for good reason," said project editor Steven Christey of Mitre in a statement.

"In 2008, hundreds of thousands of innocent, and generally trusted, Web pages were modified to serve malware by automated programs that burrowed into databases using SQL injection," he said. "The attack worked because countless programmers made the exact same mistake in their software. In a 2005 incident exploiting these same two errors, a teenager used a cross-site scripting attack to create a worm that hit the profiles of over 1 million MySpace users in less than a day, causing a temporary outage for the entire site."

The Top 25 List consists of three categories of programming errors: Insecure Interaction Between Components (nine errors), Risky Resource Management (nine errors), and Porous Defenses (seven errors). Examples of errors in the respective categories include: CWE-20: Improper Input Validation; CWE-119: Failure to Constrain Operations within the Bounds of a Memory Buffer; and CWE-285: Improper Access Control.

For the complete list and explanatory information, visit sans.org/top25 or cwe.mitre.org/top25.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5208
Published: 2014-12-22
BKBCopyD.exe in the Batch Management Packages in Yokogawa CENTUM CS 3000 through R3.09.50 and CENTUM VP through R4.03.00 and R5.x through R5.04.00, and Exaopc through R3.72.10, does not require authentication, which allows remote attackers to read arbitrary files via a RETR operation, write to arbit...

CVE-2014-7286
Published: 2014-12-22
Buffer overflow in AClient in Symantec Deployment Solution 6.9 and earlier on Windows XP and Server 2003 allows local users to gain privileges via unspecified vectors.

CVE-2014-8015
Published: 2014-12-22
The Sponsor Portal in Cisco Identity Services Engine (ISE) allows remote authenticated users to obtain access to an arbitrary sponsor's guest account via a modified HTTP request, aka Bug ID CSCur64400.

CVE-2014-8017
Published: 2014-12-22
The periodic-backup feature in Cisco Identity Services Engine (ISE) allows remote attackers to discover backup-encryption passwords via a crafted request that triggers inclusion of a password in a reply, aka Bug ID CSCur41673.

CVE-2014-8018
Published: 2014-12-22
Multiple cross-site scripting (XSS) vulnerabilities in Business Voice Services Manager (BVSM) pages in the Application Software in Cisco Unified Communications Domain Manager 8 allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug IDs CSCur19651, CSCur18555, CSCur1...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.