Software vulnerabilities up in 2008

Software vulnerabilities are up this year, especially Web
browser-based ones, according to a new report from IBM Internet
Security Systems. The X-Force 2008 Mid-Year Trend Statistics Report,
released in late July, defined a vulnerability is anything that
results "in a weakening or breakdown of the confidentiality,
integrity, or accessibility of the computing system."


Topping the list of companies reporting the most vulnerabilities
were such tech mainstays as IBM, Microsoft, Apple and Cisco
Systems. Microsoft had the third most reported vulnerabilities.
However, an interesting dimension to this year's report is that
open source software (OSS) or free software groups, such as
Mozilla's Firefox, WordPress and Joomla, also made the list of
programs with security holes in them.


Larger entities such as Microsoft or IBM make the list because
of the volume of software they produce, explained Tom Cross, an
X-Force researcher at IBM Internet Security Systems.


"Companies that make a lot of software are subject to more
disclosures," Cross added. "But we're seeing for the first time
that community-developed open source such as the Drupal and Joomla
content management software packages for the Web also showed up on
the list."


Drupal and Joomla are both OSS packages that have both been
vulnerable to recent SQL injection attacks.


Overall, the study tracked more than 3,534 disclosed
vulnerabilities in software for the first half of the year, finding
a five percent increase compared with the first half of 2007.
Leading the list of vulnerabilities were malicious spam, phishing
and different strains of malware. The nearly 80-page report found
that so-called "high risk" vulnerabilities were on the rise.


A big concern of the report was the use of the PHP scripting
language, which was associated with many vendor-identified
vulnerabilities.


PHP is mainly used by Web developers to help create dynamic Web
pages. According to the PHP Group, a research organization, PHP
was installed on more than 20 million Web sites and 1 million Web
servers as of April 2007. It is doubtless double that amount
now.


The Web is emerging as the most common vector hackers are using
these days for entry into networks, as well as to deliver malicious
software. The report's findings confirm other research saying that attacks against
trusted Web sites are up.


Moreover, hackers seem to be keeping up with security bulletins.
The report concludes that 94 percent of public exploits affecting
Web browser bugs were released on the same day as the public
security notice.



inside gcn

  • smartphone user (ShutterStock image)

    Texting trumps phone tag for offender outreach

Reader Comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group