Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

1/12/2009
04:04 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

SANS Releases List Of Top 25 Most Dangerous Programming Errors In Software

Project aimed at helping developers write more secure software and providing buyers a baseline

With the intent of raising the bar in software security, a who's who of global security organizations has collaborated in the creation of a list of the 25 most lethal programming errors found in software today, along with tips for fixing them.

The goal is to get developers to clean up their coding and ultimately create more secure software free of prevalent programming errors that most often lead to the vulnerabilities used by cybercriminals. Heavy-hitters, such as Apple, Microsoft, Symantec, RSA, CERT, Mitre, Oracle, the Department of Homeland Security, and the National Security Agency, all had a hand in coming up with the list, which was released today along with specifics on how to mitigate these coding errors.

The Top 25 drew from Mitre's massive Common Weakness Enumeration (CWE) project that documents all types of software weaknesses; to date, the CWE has more than 700 of these flaws listed in its database. "There are hundreds of different kinds of weaknesses that are covered throughout CWE, some of them very obscure. The Top 25 helps developers and customers to focus on the ones that are considered to be the most dangerous at this time. It defines a bar for determining whether software can meet minimum requirements for security," says Steve Christey, who heads up the CWE for Mitre. "[And] it gives nonexperts a tool to get started on addressing this thorny problem at the source."

Chris Wysopal, a member of the group of 41 experts who came up with the list -- which he says is about half Web application flaws and half non-Web app flaws -- says these flaws are rarely tested before software goes out. "In a lot of software, almost none of this stuff is tested for," says the co-founder and CTO of Veracode, which provides application testing services. "A lot of software companies are not doing any security testing at all."

The ultimate goal of the project is to provide developers guidelines for writing inherently more secure code by avoiding these common flaws, and allowing customers to use the list as a foundation for their software purchasing requirements. The Top 25 also will provide a base for colleges teaching secure coding, as well as for employers to ensure their programmers are writing more secure applications.

"No one has been able to point at a consensus until now of what was considered to be bad in software. This is a minimum set of what shouldn't be in software," says Wysopal, who expects organizations to begin using the list as the base for what software they will buy.

Veracode, as well as Fortify Software, says its testing tools to date root out most of the Top 25, and several state governments, including New York, plan to add the Top 25 to their software procurement language. According to SANS, the federal government's Common Criteria program also may add the Top 25 to its guidelines for secure software.

The flaws are organized into three categories -- insecure interaction between components, including errors in input validation, SQL injection, cross-site scripting, and cross-site request forgery; risky resource management, including buffer overflows, external control of critical state data, download of code without an integrity check, and improper initialization; and porous defenses, including improper access control, broken encryption algorithms, hard-coded passwords, and unnecessary privileges.

Two of the errors on the list -- improper input validation and failure to preserve SQL query structure (think SQL injection) -- accounted for more than 1.5 million Website attacks last year, according to SANS.

"Both organizations that develop software and those that procure software need to be concerned about the initial quality of software they develop and deploy, and not simply rely on a cycle of patch and install," says Robert Seacord, technical lead for the Secure Coding Initiative at the Carnegie Mellon Software Engineering Institute CERT Program.

While most of the errors that made the Top 25 are well-known, a couple of them weren't so obvious. Veracode's Wysopal says he was surprised that error-message information leaks made the list. "It sounds innocuous, but an error message can give details on how an application is structured internally and can help attackers find vulnerabilities in the application," he says. "That contributes to an application being compromised over time."

Other organizations that worked on the list included Purdue University, the University of California-Davis, KRvW Associates, Information-Technology Promotion Agency (IPA) in Japan, Cigital, Aspect Security, Secunia, iDefense Labs at VeriSign, Mandiant, Red Hat, Fortify, Hatha Systems, Northern Kentucky University, ThinkSec, Breach Security, New Access SA of Switzerland, Missing Link Security, Tata Consultancy Services (TCS), Secured Sciences Group, SAFECode, Core Security Technologies, Depository Trust & Clearing Corporation, and OWASP.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Firms Improve Threat Detection but Face Increasingly Disruptive Attacks
Robert Lemos, Contributing Writer,  2/20/2020
Ransomware Damage Hit $11.5B in 2019
Dark Reading Staff 2/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-17274
PUBLISHED: 2020-02-26
NetApp FAS 8300/8700 and AFF A400 Baseboard Management Controller (BMC) firmware versions 13.x prior to 13.1P1 were shipped with a default account enabled that could allow unauthorized arbitrary command execution via local access.
CVE-2019-17275
PUBLISHED: 2020-02-26
OnCommand Cloud Manager versions prior to 3.8.0 are susceptible to arbitrary code execution by remote attackers.
CVE-2020-3169
PUBLISHED: 2020-02-26
A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with a privilege level of root on an affected device. The vulnerability is due to insufficient validation of arguments passed to a spe...
CVE-2020-3170
PUBLISHED: 2020-02-26
A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an NX-API system process to unexpectedly restart. The vulnerability is due to incorrect validation of the HTTP header of a request that is sent to the NX-API. An attacker could expl...
CVE-2020-3171
PUBLISHED: 2020-02-26
A vulnerability in the local management (local-mgmt) CLI of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system (OS) of an affected device. The vulnerability is due to insufficient input vali...