Insecure Code: Common Vulnerabilities

Experts say the following common problems in software code, which programmers haven’t bothered to mitigate, account for the vast majority of vulnerabilities. The good news: Most of these are easily fixed if they’re found.

Buffer overflows.

If a programmer doesn’t tell a program to limit the amount of data that can go into an input field, a malfeasant can stuff that field with tons of data, flooding other parts of memory and letting the bad guy take control of the system.

Format string vulnerabilities.

Format strings are what tell, say, a printer how to present letters and numbers on a page. If a user inputs rogue code into the format string, they can take control of the computer, in a similar way to buffer overflows.

Canonicalization issues.

An attacker can bypass security checks simply by knowing that when Y program handles X program’s data, it doesn’t do the same security check.

Inadequate privilege checking.

Someone can slip in unchecked if a program doesn’t ask for authentication at every doorway to features.

Script injection.

If a programmer fails to strip out the capability to run script, attackers can enter and run it. For example, attackers could enter commands into a SQL database query that allows them to execute commands on the system.

Information leakage.

Because of poor design, some programs expose their own playbooks—directory structures, configuration information, IP addresses, passwords—to attackers who know where to look for such information.

Error handling.

A subset of information leakage, sometimes the way a program handles an error exposes information an attacker can use. For example, an e-mail bounces back and the error message might contain IP addresses, server names, or even type of server that let the attacker know how and where to hack.

Source: @Stake, CSO