Vulnerabilities / Threats
8/25/2010
10:35 AM
Connect Directly
RSS
E-Mail
50%
50%

Vulnerability Disclosures Increase By 36% In 2010

IBM report finds "escape to hypervisor" attacks a growing virtualization concern.




Slideshow: Cloud Security Pros And Cons
(click for larger image and for full photo gallery)
Vulnerability disclosures have reached record levels, with 4,396 new vulnerabilities documented in the first half of 2010 -- a 36% increase over the same period last year. That's according to a new IBM X-Force report, released Wednesday.

Web applications accounted for the majority (55%) of those vulnerability disclosures, but IBM's report cautioned that many more vulnerabilities may exist in custom web applications.

Obfuscated attacks, which allow attackers to sneak malicious code past traditional security tools, increased 52% from the first half of 2009 to the first half of 2010. JavaScript obfuscation is one particularly popular attack, said IBM, because it allows attackers "to hide their exploits within document files and web pages."

But three of the five most popular online attacks seen by IBM in the first half of 2010 involved PDF exploits. Such attacks peaked in April during a widespread spam campaign, largely driven by Zeus and Pushdo botnets distributing massive quantities of malicious PDF files via e-mail.

The good security news for the year to date is that phishing attacks have significantly declined, although the attack's primary impetus -- stealing financial data -- remains the same. Reviewing phishing e-mails, IBM found that the principal target is financial institutions (for 49% of attacks), followed by credit cards (28%), government agencies (11%), online payments (6%), and auctions (5%).

Today, virtualization vulnerabilities account for only a small subset of all code vulnerabilities. But IBM warned there's still cause for concern with virtualization security, since "35% of vulnerabilities impacting server class virtualization systems affect the hypervisor." The hypervisor is responsible for providing the platform on which guest operating systems run.

By hacking the hypervisor or gaining control of one of the virtual systems and using an "escape to hypervisor" vulnerability, an attacker might gain access to any system running on the same PC or server. The upshot is that businesses should think "about the wisdom of sharing workloads with different security requirements on the same physical hardware," according to IBM's report.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3341
Published: 2014-08-19
The SNMP module in Cisco NX-OS 7.0(3)N1(1) and earlier on Nexus 5000 and 6000 devices provides different error messages for invalid requests depending on whether the VLAN ID exists, which allows remote attackers to enumerate VLANs via a series of requests, aka Bug ID CSCup85616.

CVE-2014-3464
Published: 2014-08-19
The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers ...

CVE-2014-3472
Published: 2014-08-19
The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors.

CVE-2014-3490
Published: 2014-08-19
RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have...

CVE-2014-3504
Published: 2014-08-19
The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Dark Reading continuing coverage of the Black Hat 2014 conference brings interviews and commentary to Dark Reading listeners.