Vulnerabilities / Threats

4/8/2016
10:20 AM
50%
50%

Thousands Of Vulnerabilities Found In Corporate Networks

F-Secure research discovers tens of thousands of holes in

An investigation conducted by F-Secure early this year revealed thousands of instances of companies using misconfigured systems and outdated software in corporate networks. The security firm reviewed 85,000 security events of the 100 most common vulnerabilities using its vulnerability scanner/management solution.

Some 7% of the reviewed security events contained high severity ratings and nearly half of them were found easily exploitable via remote code execution. F-Secure's findings revealed that the 10 most common security weaknesses were actually low severity vulnerabilities, and accounted for more than 61% of all vulnerabilities discovered. 

"It's bad news for a company if an attacker finds one of these highly severe vulnerabilities. The fact that we found thousands of issues this severe suggests some serious security shortfalls amongst companies. Either they're not implementing patch management programs, or they're forgetting to include parts of their network in their maintenance practices," said Jarno Niemelä, lead researcher, F-Secure Labs.

Read the F-Secure press release for more on the investigation findings.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
The Fundamental Flaw in Security Awareness Programs
Ira Winkler, CISSP, President, Secure Mentem,  7/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-5065
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVE-2018-5066
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVE-2018-5067
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Heap Overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVE-2018-5068
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVE-2018-5069
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.