Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

Study: 96 Percent Of Applications Have Security Vulnerabilities

Nearly all applications tested have security flaws, Cenzic study says; information leakage is chief culprit

Enterprises and software developers are starting to get control of old vulnerabilities such as SQL injection and cross-site scripting, according to a study published this week. But new vulnerabilities are taking their place, leaving flaws in nearly every application tested.

Ninety-six percent of applications tested have at least one security vulnerability, according to a study published by application security firm Cenzic earlier this week. This figure has dropped slightly -- the same study turned up flaws in 99% of apps in 2011 and 1012 -- but the vulnerabilities remain nearly ubiquitous.

In fact, the median number of vulnerabilities per application found in this year's study – 14 – is actually greater than it was in the previous year – 13.

"While some improvements in the development process have been made, other newer areas of vulnerability have emerged," says Bala Venkat, chief marketing officer at Cenzic, which compiled the numbers through an analysis of production applications scanned by its tools. "It's a graphic illustration of the gigantic game of whack-a-mole that enterprises and software developers are playing – and a clear message that it's time to rethink the way we develop and test our applications."

Information leakage -- in which an application exposes information about itself, its connections, or its users -- was the primary category of vulnerability in this year's study, accounting for almost one quarter (23 percent) of security flaws. This category displaced older vulnerabilities such as cross-site scripting (XSS), which still is found in almost as many applications.

"We found that the growth of mobile and cloud applications is causing a slight shift in the types of vulnerabilities we are finding," Venkat says. "But the prevalence of vulnerabilities has not changed significantly."

Enterprises and their software development teams need to rethink their processes, Venkat says, focusing more attention on security during the development cycle.

"Web application firewalls can also help enterprises identify vulnerabilities early and prevent them from leading to greater damage," Venkat says. Closer attention to basic issues such as server configuration can also help enterprises to minimize the impact of vulnerabilities in their applications, he adds.

"One of the chief obstacles that remain is to get software developers and enterprises to stop thinking of vulnerability scanning as a one-time project," Venkat stated. "As web applications evolve and make their journey traversing various production environments, the incidence of vulnerabilities is growing, not shrinking. Applications development and security teams must get together and implement a plan for continuous proactive monitoring of vulnerabilities, rather than the traditional, annual quality assessment."

Have a comment on this story? Please click "Add a Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
shjacks55
50%
50%
shjacks55,
User Rank: Apprentice
3/7/2014 | 7:25:00 AM
re: Study: 96 Percent Of Applications Have Security Vulnerabilities
You must be an old 68000 Mac guy. Or an ARM fanboy. Intel processors have had 4 security rings since 386 and S/390 had more (VM/CMS). Took a speed hit to write good code (no speed hit with newer CPUs but bad habits die hard). Intel depreciated then removed the Bounds instruction (limits buffer overflow) because it 'slowed down code' and stalled the pipeline. Lazy programmers for hardware vendors still write user mode drivers for hardware networking devices. (Bad when network gets busy.)
Linux is by no means perfect; programs like Flash run in Kernel and crash my Linux boxes. Mac (on BSD base OS) keeps less in the kernel mode and is more stable than Linux.
The largest US Retailers use Java POS S/W running on SUSE Linux. Older, exploit vulnerable Java. But these POS only talk to the Store Server which only talks to the Corporate Data Center: like Target's System.
macker490
50%
50%
macker490,
User Rank: Ninja
2/25/2014 | 1:26:15 PM
re: Study: 96 Percent Of Applications Have Security Vulnerabilities
errors in app programs are normal. this is why computers have kernel mode and user mode. it's been that way since 1964 when System/360 announced "multi-programming".

there are only 2 rules to computer security:
1. the o/s must not permit any un-authorized updates to itself.
2. the system owner/operator must be able to regulate what an application program or user is allowed to do.

the later was introduced to system 360 with RACF: 1974 these rules are also operational in Unix/Linux systems.

product liability: the o/s builder is responsible for making sure the tools (1, & 2, above) are effective. the system owner/operator is responsible for applying the rules.
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-3539
PUBLISHED: 2021-08-04
EspoCRM 6.1.6 and prior suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images. This issue was fixed in version 6.1.7 of the product.
CVE-2021-36801
PUBLISHED: 2021-08-04
Akaunting version 2.1.12 and earlier suffers from an authentication bypass issue in the user-controllable field, companies[0]. This issue was fixed in version 2.1.13 of the product.
CVE-2021-36802
PUBLISHED: 2021-08-04
Akaunting version 2.1.12 and earlier suffers from a denial-of-service issue that is triggered by setting a malformed 'locale' variable and sending it in an otherwise normal HTTP POST request. This issue was fixed in version 2.1.13 of the product.
CVE-2021-36803
PUBLISHED: 2021-08-04
Akaunting version 2.1.12 and earlier suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images. This issue was fixed in version 2.1.13 of the product.
CVE-2021-36804
PUBLISHED: 2021-08-04
Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy password reset requests through a running Akaunting instance, if that attacker knows the target's e-mail address. This issue was fixed in version 2.1.13 of the product. Please not...