Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


04:04 PM
Connect Directly

SANS Releases List Of Top 25 Most Dangerous Programming Errors In Software

Project aimed at helping developers write more secure software and providing buyers a baseline

With the intent of raising the bar in software security, a who's who of global security organizations has collaborated in the creation of a list of the 25 most lethal programming errors found in software today, along with tips for fixing them.

The goal is to get developers to clean up their coding and ultimately create more secure software free of prevalent programming errors that most often lead to the vulnerabilities used by cybercriminals. Heavy-hitters, such as Apple, Microsoft, Symantec, RSA, CERT, Mitre, Oracle, the Department of Homeland Security, and the National Security Agency, all had a hand in coming up with the list, which was released today along with specifics on how to mitigate these coding errors.

The Top 25 drew from Mitre's massive Common Weakness Enumeration (CWE) project that documents all types of software weaknesses; to date, the CWE has more than 700 of these flaws listed in its database. "There are hundreds of different kinds of weaknesses that are covered throughout CWE, some of them very obscure. The Top 25 helps developers and customers to focus on the ones that are considered to be the most dangerous at this time. It defines a bar for determining whether software can meet minimum requirements for security," says Steve Christey, who heads up the CWE for Mitre. "[And] it gives nonexperts a tool to get started on addressing this thorny problem at the source."

Chris Wysopal, a member of the group of 41 experts who came up with the list -- which he says is about half Web application flaws and half non-Web app flaws -- says these flaws are rarely tested before software goes out. "In a lot of software, almost none of this stuff is tested for," says the co-founder and CTO of Veracode, which provides application testing services. "A lot of software companies are not doing any security testing at all."

The ultimate goal of the project is to provide developers guidelines for writing inherently more secure code by avoiding these common flaws, and allowing customers to use the list as a foundation for their software purchasing requirements. The Top 25 also will provide a base for colleges teaching secure coding, as well as for employers to ensure their programmers are writing more secure applications.

"No one has been able to point at a consensus until now of what was considered to be bad in software. This is a minimum set of what shouldn't be in software," says Wysopal, who expects organizations to begin using the list as the base for what software they will buy.

Veracode, as well as Fortify Software, says its testing tools to date root out most of the Top 25, and several state governments, including New York, plan to add the Top 25 to their software procurement language. According to SANS, the federal government's Common Criteria program also may add the Top 25 to its guidelines for secure software.

The flaws are organized into three categories -- insecure interaction between components, including errors in input validation, SQL injection, cross-site scripting, and cross-site request forgery; risky resource management, including buffer overflows, external control of critical state data, download of code without an integrity check, and improper initialization; and porous defenses, including improper access control, broken encryption algorithms, hard-coded passwords, and unnecessary privileges.

Two of the errors on the list -- improper input validation and failure to preserve SQL query structure (think SQL injection) -- accounted for more than 1.5 million Website attacks last year, according to SANS.

"Both organizations that develop software and those that procure software need to be concerned about the initial quality of software they develop and deploy, and not simply rely on a cycle of patch and install," says Robert Seacord, technical lead for the Secure Coding Initiative at the Carnegie Mellon Software Engineering Institute CERT Program.

While most of the errors that made the Top 25 are well-known, a couple of them weren't so obvious. Veracode's Wysopal says he was surprised that error-message information leaks made the list. "It sounds innocuous, but an error message can give details on how an application is structured internally and can help attackers find vulnerabilities in the application," he says. "That contributes to an application being compromised over time."

Other organizations that worked on the list included Purdue University, the University of California-Davis, KRvW Associates, Information-Technology Promotion Agency (IPA) in Japan, Cigital, Aspect Security, Secunia, iDefense Labs at VeriSign, Mandiant, Red Hat, Fortify, Hatha Systems, Northern Kentucky University, ThinkSec, Breach Security, New Access SA of Switzerland, Missing Link Security, Tata Consultancy Services (TCS), Secured Sciences Group, SAFECode, Core Security Technologies, Depository Trust & Clearing Corporation, and OWASP.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Cybersecurity Industry: It's Time to Stop the Victim Blame Game
Jessica Smith, Senior Vice President, The Crypsis Group,  2/25/2020
5 Ways to Up Your Threat Management Game
Wayne Reynolds, Advisory CISO, Kudelski Security,  2/26/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-02-28
A denial of service issue was addressed with improved input validation.
PUBLISHED: 2020-02-28
The Avast AV parsing engine allows virus-detection bypass via a crafted ZIP archive. This affects versions before 12 definitions 200114-0 of Antivirus Pro, Antivirus Pro Plus, and Antivirus for Linux.
PUBLISHED: 2020-02-28
OpenVPN Connect on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10, which allows local users to gain privileges by copying a malicious drvstore.dll there.
PUBLISHED: 2020-02-28
UNIX Symbolic Link (Symlink) Following vulnerability in the cronjob shipped with nagios of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 11; openSUSE Factory allows local attackers to cause cause DoS or potentially escalate privileges by winning a race. This issue affects: SUSE Linux...
PUBLISHED: 2020-02-27
In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the LTE RRC dissector could leak memory. This was addressed in epan/dissectors/packet-lte-rrc.c by adjusting certain append operations.