syssec_red_book

4 Software VulnerabilitiesExtending its definition in the physical world, in computer securitya vulnerability is a weakness or flaw in one or more software componentsthat can be exploited to compromise the integrity, confidentiality,or availability of a system and its information resources [217]. Besides software,vulnerabilities may exist in other aspects of a system, including protocol design,hardware, system configuration, and operational procedures. After many yearsof security research and engineering, software vulnerabilities remain one ofthe primary methods of reducing a system’s information assurance.The massive complexity of modern software is one of the main reasonsfor the existence of flaws that can lead to system compromise. Vendors alsooften give security design a secondary priority in favor of rich features, time tomarket, performance, and overall cost. At the same time, the incessant huntfor new vulnerabilities by malicious hackers, criminals, spies, and even nationstates, has resulted in the continuous discovery of new vulnerabilities and inmajor advances in exploitation techniques.Common types of software flaws that can lead to vulnerabilities that couldbe exploited by a malicious adversary include:Memory errors: buffer overflows, dynamic memory errors (dangling pointers,double or invalid frees, null pointer dereferences), uninitialized variables.Input validation errors: code or command injection, SQL injection, uncontrolledformat strings, cross-site scripting (XSS), directory traversal.Race conditions: simultaneous access, time-of-check-to-time-of-use (TOCTOU)bugs.Privilege-confusion: cross-site request forgery (CSRF), clickjacking.In 2011, the MITRE corporation, an American not-for-profit organization,through its Common Weakness Enumeration (CWE) effort, a communitydevelopeddictionary of software weakness types, compiled a list of the mostwidespread and critical errors that can lead to serious software vulnerabilities[66]. Organized into three categories, the top 25 most frequently exploitedsoftware flaws are: