Common Vulnerabilities

Experts say the following common problems in software code, which programmers haven't bothered to mitigate, account for the vast majority of vulnerabilities. The good news: most of these are easily fixed if they're found.

Buffer overflows. If a programmer doesn't tell a program to limit the amount of data that can go into an input field, a malfeasant can stuff that field with tons of data, flooding other parts of memory and letting the bad guy take control of the system.

Format string vulnerabilities. Format strings are what tell, say, a printer how to present letters and numbers on a page. If a user inputs rogue code into the format string, they can take control of the computer, in a similar way to buffer overflows.

Canonicalisation issues. An attacker can bypass security checks simply by knowing that when Y program handles X program's data, it doesn't do the same security check.

Inadequate privilege checking. Someone can slip in unchecked if a program doesn't ask for authentication at every doorway to features.

Script injection. If a programmer fails to strip out the capability to run script, attackers can enter and run it. For example, attackers could enter commands into a SQL database query that allows them to execute commands on the system.

Information leakage. Because of poor design, some programs expose their own playbooks - directory structures, configuration information, IP addresses, passwords - to attackers who know where to look for such information.

Error handling. A subset of information leakage, sometimes the way a program handles an error exposes information an attacker can use. For example, an e-mail bounces back and the error message might contain IP addresses, server names, or even type of server that let the attacker know how and where to hack.

Source:@STAKE.CSO

Put It in Writing

This is from a contract between GE and software vendor General Magic Incorporated (GMI), from earlier this year, which, experts say, represents some of the strongest language to date that software users have crafted to hold software vendors accountable for the quality of their code. It also creates clout-by-proxy: if General Magic has to make sure the code conforms for GE, it will conform for all users of the product.

7.3 Code Integrity Warranty. GMI warrants and represents that the GMI software, other than the key software, does not and will not contain any program routine, device, code or instructions (including any code or instructions provided by third parties) or other undisclosed feature, including, without limitation, a time bomb, virus, software lock, drop-dead device, malicious logic, worm, Trojan horse, bug, error, defect or trap door (including year 2000), that is capable of accessing, modifying, deleting, damaging, disabling, deactivating, interfering with or otherwise harming the GMI software, any computers, networks, data or other electronically stored information, or computer programs or systems (collectively, "disabling procedures"). Such representation and warranty applies regardless of whether such disabling procedures are authorised by GMI to be included in the GMI software. If GMI incorporates into the GMI software programs or routines supplied by other vendors, licensors or contractors (other than the key software), GMI shall obtain comparable warranties from such providers or GMI shall take appropriate action to ensure that such programs or routines are free of disabling procedures. Notwithstanding any other limitations in this agreement, GMI agrees to notify GE immediately upon discovery of any disabling procedures that are or may be included in the GMI software, and, if disabling procedures are discovered or reasonably suspected to be present in the GMI software, GMI, as its entire liability and GE's sole and exclusive remedy for the breach of the warranty in this section 7.3, agrees to take action immediately, at its own expense, to identify and eradicate (or to equip GE to identify and eradicate) such disabling procedures and carry out any recovery necessary to remedy any impact of such disabling procedures.

Source: FreeEdgar.com/SEC