Risk
6/27/2011
03:07 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Feds Identify Top 25 Software Vulnerabilities

Department of Homeland Security worked with non-profits and the private sector to come up with a list of the most worrisome threats and how organizations can mitigate them.

Inside DHS' Classified Cyber-Coordination Headquarters
(click image for larger view)
Slideshow: Inside DHS' Classified Cyber-Coordination Headquarters
The Department of Homeland Security on Monday announced detailed guidance for how software companies and others writing code can avoid the most widespread and serious vulnerabilities in software.

Working with technology research non-profit Mitre and security training organization the SANS Instittute, as well as a number of private sector organizations from Apple to Oracle, DHS' National Cyber Security Division drew up a list of software vulnerabilities called the Common Weakness Enumeration, developed a scoring system and risk analysis framework for evaluating the seriousness of the flaws and prioritizing the weaknesses, and released a top 25 list of the most dangerous software errors.

The list includes high-level overviews and examples of each of the vulnerabilities, common consequences of the problem, likely modes of detection and attack, and potential mitigations for each type of attack at various steps in the software development process.

Initiative leaders anticipate that the Common Weakness Enumeration, top 25 list, and scoring system will let users compare weaknesses, educate themselves, and prioritize their security efforts. This isn't the first release of the top 25 list or of the Common Weakness Enumeration, but is the first one to take as detailed and data-intensive look at the vulnerabilities, thus making it significantly more useful than previous versions, initiative leaders said on a conference call about the effort.

"This will allow agencies and organizations to take a tactical approach to addressing vulnerabilities." Will Pelgrin, director of the Multi-State Information Sharing and Analysis Center, a collaborative cybersecurity effort that includes state and local governments, said on the call. "I see this as a management tool to focus the team on things that are the greatest threat and that have the greatest consequences."

Atop this year's list are SQL injection flaws, which are the most serious due to their common nature and the ease and frequency of exploit online. Other top vulnerabilities include operating system command injection, classic buffer overflow, and cross-site scripting.

The effort is exemplary of the increasing frequency with which DHS is collaborating with the private sector on cybersecurity efforts. In addition to this initiative, for example, DHS' National Cybersecurity and Communications Integration Center has private sector reps working side by side with feds to uncover and address vulnerabilities in their systems, and the IT sector has worked on a major risk assessment effort with DHS.

"Whether you call it partnership or collaboration, the relationship between the government and the private sector has been on the increase," Joe Jarzombek, director for software assurance at the National Cyber Security Division, said on the call.

The scoring system takes into consideration the potential technical and business impacts of exploited weaknesses, the operational layer to which the attacker might gain access (i.e. application-level versus, say, network-level), the effectiveness of available mitigating controls, the privilege level needed to access the vulnerability, the likelihood of discovery and exploit of the weakness, and more.

What industry can teach government about IT innovation and efficiency. Also in the new, all-digital issue of InformationWeek Government: Federal agencies have to shift from annual IT security assessments to continuous monitoring of their risks. Download it now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2004-2771
Published: 2014-12-24
The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.

CVE-2014-3569
Published: 2014-12-24
The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1j does not properly handle attempts to use unsupported protocols, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an unexpected handshake, as demonstrated by an SSLv3 handshak...

CVE-2014-4322
Published: 2014-12-24
drivers/misc/qseecom.c in the QSEECOM driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not validate certain offset, length, and base values within an ioctl call, which allows attackers to gain privileges or c...

CVE-2014-6132
Published: 2014-12-24
Cross-site scripting (XSS) vulnerability in the Web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.3 through 6.3.0.5, 7.0.x through 7.0.0.5, 7.5.x through 7.5.0.4, 8.0.x before 8.0.0.3, and 8.5.x before 8.5.0.1 allows remote authenticated users to inject arbitrary web script or HTML vi...

CVE-2014-6153
Published: 2014-12-24
The Web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.3.x through 6.3.0.5, 7.0.x through 7.0.0.5, 7.5.x through 7.5.0.4, 8.0.x before 8.0.0.3, and 8.5.x before 8.5.0.1 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture ...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.