Risk
1/12/2009
04:04 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

SANS Releases List Of Top 25 Most Dangerous Programming Errors In Software

Project aimed at helping developers write more secure software and providing buyers a baseline

With the intent of raising the bar in software security, a who's who of global security organizations has collaborated in the creation of a list of the 25 most lethal programming errors found in software today, along with tips for fixing them.

The goal is to get developers to clean up their coding and ultimately create more secure software free of prevalent programming errors that most often lead to the vulnerabilities used by cybercriminals. Heavy-hitters, such as Apple, Microsoft, Symantec, RSA, CERT, Mitre, Oracle, the Department of Homeland Security, and the National Security Agency, all had a hand in coming up with the list, which was released today along with specifics on how to mitigate these coding errors.

The Top 25 drew from Mitre's massive Common Weakness Enumeration (CWE) project that documents all types of software weaknesses; to date, the CWE has more than 700 of these flaws listed in its database. "There are hundreds of different kinds of weaknesses that are covered throughout CWE, some of them very obscure. The Top 25 helps developers and customers to focus on the ones that are considered to be the most dangerous at this time. It defines a bar for determining whether software can meet minimum requirements for security," says Steve Christey, who heads up the CWE for Mitre. "[And] it gives nonexperts a tool to get started on addressing this thorny problem at the source."

Chris Wysopal, a member of the group of 41 experts who came up with the list -- which he says is about half Web application flaws and half non-Web app flaws -- says these flaws are rarely tested before software goes out. "In a lot of software, almost none of this stuff is tested for," says the co-founder and CTO of Veracode, which provides application testing services. "A lot of software companies are not doing any security testing at all."

The ultimate goal of the project is to provide developers guidelines for writing inherently more secure code by avoiding these common flaws, and allowing customers to use the list as a foundation for their software purchasing requirements. The Top 25 also will provide a base for colleges teaching secure coding, as well as for employers to ensure their programmers are writing more secure applications.

"No one has been able to point at a consensus until now of what was considered to be bad in software. This is a minimum set of what shouldn't be in software," says Wysopal, who expects organizations to begin using the list as the base for what software they will buy.

Veracode, as well as Fortify Software, says its testing tools to date root out most of the Top 25, and several state governments, including New York, plan to add the Top 25 to their software procurement language. According to SANS, the federal government's Common Criteria program also may add the Top 25 to its guidelines for secure software.

The flaws are organized into three categories -- insecure interaction between components, including errors in input validation, SQL injection, cross-site scripting, and cross-site request forgery; risky resource management, including buffer overflows, external control of critical state data, download of code without an integrity check, and improper initialization; and porous defenses, including improper access control, broken encryption algorithms, hard-coded passwords, and unnecessary privileges.

Two of the errors on the list -- improper input validation and failure to preserve SQL query structure (think SQL injection) -- accounted for more than 1.5 million Website attacks last year, according to SANS.

"Both organizations that develop software and those that procure software need to be concerned about the initial quality of software they develop and deploy, and not simply rely on a cycle of patch and install," says Robert Seacord, technical lead for the Secure Coding Initiative at the Carnegie Mellon Software Engineering Institute CERT Program.

While most of the errors that made the Top 25 are well-known, a couple of them weren't so obvious. Veracode's Wysopal says he was surprised that error-message information leaks made the list. "It sounds innocuous, but an error message can give details on how an application is structured internally and can help attackers find vulnerabilities in the application," he says. "That contributes to an application being compromised over time."

Other organizations that worked on the list included Purdue University, the University of California-Davis, KRvW Associates, Information-Technology Promotion Agency (IPA) in Japan, Cigital, Aspect Security, Secunia, iDefense Labs at VeriSign, Mandiant, Red Hat, Fortify, Hatha Systems, Northern Kentucky University, ThinkSec, Breach Security, New Access SA of Switzerland, Missing Link Security, Tata Consultancy Services (TCS), Secured Sciences Group, SAFECode, Core Security Technologies, Depository Trust & Clearing Corporation, and OWASP.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0619
Published: 2014-10-23
Untrusted search path vulnerability in Hamster Free ZIP Archiver 2.0.1.7 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the current working directory.

CVE-2014-2230
Published: 2014-10-23
Open redirect vulnerability in the header function in adclick.php in OpenX 2.8.10 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) dest parameter to adclick.php or (2) _maxdest parameter to ck.php.

CVE-2014-7281
Published: 2014-10-23
Cross-site request forgery (CSRF) vulnerability in Shenzhen Tenda Technology Tenda A32 Router with firmware 5.07.53_CN allows remote attackers to hijack the authentication of administrators for requests that reboot the device via a request to goform/SysToolReboot.

CVE-2014-7292
Published: 2014-10-23
Open redirect vulnerability in the Click-Through feature in Newtelligence dasBlog 2.1 (2.1.8102.813), 2.2 (2.2.8279.16125), and 2.3 (2.3.9074.18820) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter to ct.ashx.

CVE-2014-8071
Published: 2014-10-23
Multiple cross-site scripting (XSS) vulnerabilities in OpenMRS 2.1 Standalone Edition allow remote attackers to inject arbitrary web script or HTML via the (1) givenName, (2) familyName, (3) address1, or (4) address2 parameter to registrationapp/registerPatient.page; the (5) comment parameter to all...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.