third Cyber Security Assessment Netherlands - NCSC

Detailed section » 7 Vulnerability of IT
Development in new web-based vulnerabilities 2005-2012
1200
1000
800
»
600
400
200
0
y2005
y2006
y2007
y2008
y2009
y2010
y2011
y2012
XSS SQL injection CSRF
Figure 7. Development in web-based vulnerabilities
7.2.2 Impact of vulnerabilities in software
An analysis of the CVE registrations and NCSC security advisories
reveals that the majority of vulnerabilities have a moderate impact:
this is true of approximately 40 to 61 per cent of all vulnerabilities
(Figure 6). There has been little change in the impact of vulnerabilities
over the previous four quarters.
What is notable is that the proportion of vulnerabilities with the
highest CVSS score (10) has increased in recent years. This means that
an increasing proportion of the vulnerabilities are easy to exploit
(remotely, not complex and without authentication) and they also
have a high impact (availability, integrity and confidentiality are all
compromised). This highlights the importance of patching software.
7.2.3 Causes of vulnerabilities in software
Table 8 describes the top 10 causes of vulnerabilities throughout the
reporting period of this CSAN.
Research shows that errors concerning memory management
(primarily buffer overflow) in standard software have been the most
common vulnerabilities for over 25 years, despite the raft of
[55: VU 2012]
measures that have been developed in the meantime.
Description
Number of registrations
1 Buffer overflow 625
2 Cross-site scripting (XSS) 556
3 Insufficient input validation 503
4
Problem with authorisation and
access control
498
5 Resource management 283
6
Accidental disclosure of
information
184
7 SQL injection 146
8
Computing and conversion
errors
124
9 Cross-site request forgery (CSRF) 122
10 Code injection 105
Table 8. Major causes of vulnerabilities
It is notable that many of the vulnerabilities are related to web
applications: cross-site scripting (XSS), SQL injection and cross-site
request forgery (CSRF) are common in web applications and are
therefore the cause of many vulnerabilities. There has been a clear
decline in SQL injection following a peak in 2008 (Figure 7). There has
unfortunately been an increase in XSS. This is noteworthy, certainly
given the fact that developers now assume XSS to be a known
vulnerability. The graph below outlines the trend in developments
of these web-based vulnerabilities during recent years.
81