Vulnerabilities / Threats

5/6/2016
11:00 AM
Jai Vijayan
Jai Vijayan
Slideshows
Connect Directly
Twitter
LinkedIn
RSS
E-Mail

The 10 Worst Vulnerabilities of The Last 10 Years

From the thousands of vulns that software vendors disclosed over the past 10 years, a few stand out for being a lot scarier than the rest.
1 of 11

Image Source: Software Bug

Image Source: Software Bug

1 of 11
Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
nathanwburke
50%
50%
nathanwburke,
User Rank: Author
5/9/2016 | 12:05:52 PM
Re: OS vulnerabilities
It's a good point you raise about Mac vulnerabilities. Macs are certainly increasing in the enterprise, yet security products have been largely windows-centric. With attackers looking for a way in to gain access to other data on the network, a macbook without the same protection as the windows machines would be an attractive target. 
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
5/9/2016 | 9:14:01 AM
Re: OS vulnerabilities
@Ryan: Plus, only in the past few years have people even started to pay much attention to Apple platform security.  For years, as Apple's market share was relatively tiny, people -- including attackers -- didn't care much.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
5/9/2016 | 7:45:29 AM
Shellshock and Heartbleed
As they were not too long ago I know all to well the scramblings behind trying to remediate these two major vulnerabilities. They were so well publicized that non-security sides of the organization were inquiring about the patching efforts.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
5/9/2016 | 7:41:56 AM
Re: OS vulnerabilities
Yes, I think you will start to see this as more of a commonality with the increasing Mac footprint in the market. It hasn't quite extended over to the corporate side as fast as it has from a personal perspective but regardless Mac is definitely becoming more prevalent then before. With that comes more code for the OS and more opportunities for open holes.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
5/8/2016 | 12:03:07 PM
OS vulnerabilities
It's one thing to look at the past ten years in a single lump, but it's also worth noting that many more vulnerabilities are being found for Apple OS's than Microsoft OS's these days.

Case in point: informationweek.com/ios-security-reports-say-no-iphone-is-safe/a/d-id/1319750
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Are you sure this is how we get our data into the cloud?
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17437
PUBLISHED: 2018-09-24
Memory leak in the H5O_dtype_decode_helper() function in H5Odtype.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service (memory consumption) via a crafted HDF5 file.
CVE-2018-17438
PUBLISHED: 2018-09-24
A SIGFPE signal is raised in the function H5D__select_io() of H5Dselect.c in the HDF HDF5 through 1.10.3 library during an attempted parse of a crafted HDF file, because of incorrect protection against division by zero. It could allow a remote denial of service attack.
CVE-2018-17439
PUBLISHED: 2018-09-24
An issue was discovered in the HDF HDF5 1.10.3 library. There is a stack-based buffer overflow in the function H5S_extent_get_dims() in H5S.c. Specifically, this issue occurs while converting an HDF5 file to a GIF file.
CVE-2018-17432
PUBLISHED: 2018-09-24
A NULL pointer dereference in H5O_sdspace_encode() in H5Osdspace.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service via a crafted HDF5 file.
CVE-2018-17433
PUBLISHED: 2018-09-24
A heap-based buffer overflow in ReadGifImageDesc() in gifread.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service via a crafted HDF5 file. This issue was triggered while converting a GIF file to an HDF file.