Risk
1/12/2009
04:04 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

SANS Releases List Of Top 25 Most Dangerous Programming Errors In Software

Project aimed at helping developers write more secure software and providing buyers a baseline

With the intent of raising the bar in software security, a who's who of global security organizations has collaborated in the creation of a list of the 25 most lethal programming errors found in software today, along with tips for fixing them.

The goal is to get developers to clean up their coding and ultimately create more secure software free of prevalent programming errors that most often lead to the vulnerabilities used by cybercriminals. Heavy-hitters, such as Apple, Microsoft, Symantec, RSA, CERT, Mitre, Oracle, the Department of Homeland Security, and the National Security Agency, all had a hand in coming up with the list, which was released today along with specifics on how to mitigate these coding errors.

The Top 25 drew from Mitre's massive Common Weakness Enumeration (CWE) project that documents all types of software weaknesses; to date, the CWE has more than 700 of these flaws listed in its database. "There are hundreds of different kinds of weaknesses that are covered throughout CWE, some of them very obscure. The Top 25 helps developers and customers to focus on the ones that are considered to be the most dangerous at this time. It defines a bar for determining whether software can meet minimum requirements for security," says Steve Christey, who heads up the CWE for Mitre. "[And] it gives nonexperts a tool to get started on addressing this thorny problem at the source."

Chris Wysopal, a member of the group of 41 experts who came up with the list -- which he says is about half Web application flaws and half non-Web app flaws -- says these flaws are rarely tested before software goes out. "In a lot of software, almost none of this stuff is tested for," says the co-founder and CTO of Veracode, which provides application testing services. "A lot of software companies are not doing any security testing at all."

The ultimate goal of the project is to provide developers guidelines for writing inherently more secure code by avoiding these common flaws, and allowing customers to use the list as a foundation for their software purchasing requirements. The Top 25 also will provide a base for colleges teaching secure coding, as well as for employers to ensure their programmers are writing more secure applications.

"No one has been able to point at a consensus until now of what was considered to be bad in software. This is a minimum set of what shouldn't be in software," says Wysopal, who expects organizations to begin using the list as the base for what software they will buy.

Veracode, as well as Fortify Software, says its testing tools to date root out most of the Top 25, and several state governments, including New York, plan to add the Top 25 to their software procurement language. According to SANS, the federal government's Common Criteria program also may add the Top 25 to its guidelines for secure software.

The flaws are organized into three categories -- insecure interaction between components, including errors in input validation, SQL injection, cross-site scripting, and cross-site request forgery; risky resource management, including buffer overflows, external control of critical state data, download of code without an integrity check, and improper initialization; and porous defenses, including improper access control, broken encryption algorithms, hard-coded passwords, and unnecessary privileges.

Two of the errors on the list -- improper input validation and failure to preserve SQL query structure (think SQL injection) -- accounted for more than 1.5 million Website attacks last year, according to SANS.

"Both organizations that develop software and those that procure software need to be concerned about the initial quality of software they develop and deploy, and not simply rely on a cycle of patch and install," says Robert Seacord, technical lead for the Secure Coding Initiative at the Carnegie Mellon Software Engineering Institute CERT Program.

While most of the errors that made the Top 25 are well-known, a couple of them weren't so obvious. Veracode's Wysopal says he was surprised that error-message information leaks made the list. "It sounds innocuous, but an error message can give details on how an application is structured internally and can help attackers find vulnerabilities in the application," he says. "That contributes to an application being compromised over time."

Other organizations that worked on the list included Purdue University, the University of California-Davis, KRvW Associates, Information-Technology Promotion Agency (IPA) in Japan, Cigital, Aspect Security, Secunia, iDefense Labs at VeriSign, Mandiant, Red Hat, Fortify, Hatha Systems, Northern Kentucky University, ThinkSec, Breach Security, New Access SA of Switzerland, Missing Link Security, Tata Consultancy Services (TCS), Secured Sciences Group, SAFECode, Core Security Technologies, Depository Trust & Clearing Corporation, and OWASP.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6306
Published: 2014-08-22
Unspecified vulnerability on IBM Power 7 Systems 740 before 740.70 01Ax740_121, 760 before 760.40 Ax760_078, and 770 before 770.30 01Ax770_062 allows local users to gain Service Processor privileges via unknown vectors.

CVE-2014-0232
Published: 2014-08-22
Multiple cross-site scripting (XSS) vulnerabilities in framework/common/webcommon/includes/messages.ftl in Apache OFBiz 11.04.01 before 11.04.05 and 12.04.01 before 12.04.04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a (1)...

CVE-2014-3525
Published: 2014-08-22
Unspecified vulnerability in Apache Traffic Server 4.2.1.1 and 5.x before 5.0.1 has unknown impact and attack vectors, possibly related to health checks.

CVE-2014-3563
Published: 2014-08-22
Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.

CVE-2014-3587
Published: 2014-08-22
Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. NOTE: this vulnerability exists bec...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.