Top 25 software vulnerabilities
Connecting state and local government leaders
The Common Weakness Enumeration list's first update since 2011 ranks weaknesses based errors’ prevalence and severity.
Improper restriction of operations within the bounds of a memory buffer is the most serious common software weakness today, according to the latest ranking of coding errors. It means that in addition to performing normal operations on a memory buffer, the software can read from or write to a memory location outside that buffer’s boundary, potentially causing a software fault that hackers can exploit to gain access to the system.
The finding, announced in October, comes from the first update to the Common Weakness Enumeration Top 25 Most Dangerous Software Errors list since 2011. The Homeland Security Systems Engineering and Development Institute, operated by Mitre, published the first CWE list in 2008.
The list is a ranking of weaknesses based on numeric scores calculated with a formula that accounts for errors’ prevalence and severity. Those that are common and can cause significant harm get a high score on the CWE. For instance, the highest was 75.56, with the second-highest (“improper neutralization of input during web page generation”) coming in at 45.69 and the third (improper input validation) at 43.61. The error with the lowest ranking -- 4.06 -- is improper certificate validation. The full list is available here.
By comparison, the biggest risk in 2011 was improper neutralization of special elements used in an SQL command (‘SQL injection’), which lets attackers skirt security to access internal data. Now, SQL injection has dropped down to the No. 6 spot.
A main reason for the difference in ranking is the methodology, according to DHS officials. In 2011, analysts took a subjective tack that included conducting personal interviews and surveys of experts. This year, CWE, sponsored by DHS' Cybersecurity and Infrastructure Security Agency, used about 25,000 common vulnerabilities and exposures entries from 2017 and 2018 that were published in the National Vulnerability Database.
NVD provides a common vulnerability scoring system score that represents the potential severity of a vulnerability based on standard characteristics. “This approach provides an objective look at what vulnerabilities are currently seen in the real world, creates a foundation built on publicly reported vulnerabilities instead of relying on surveys and opinions, and makes the process repeatable in future years,” according to CWE.
“We shifted to a data-driven approach because it enables a more consistent and repeatable analysis that reflects the issues we are seeing in the real world,” CWE project leader Chris Levendis said in a DHS statement. “We will continue to mature the methodology as we move forward.”
Consideration of the scores is important given software’s presence in virtually all areas of life. "Eliminating weaknesses prior to software entering the marketplace is an important step in reducing the attack surface which better protects everybody, anywhere in the world," Levendis said.