IPA/ISEC：Vulnerabilities：JVN iPedia Registration Status for 2008 2Q

During the second quarter of 2008 (from April 1 to June 30), the total of 298 vulnerabilities, of which 8 are collected from domestic software developers, 24 from JVN and 266 from NVD, have been registered to JVN iPedia (Table 1 and Figure 1). The total sum of vulnerabilities registered since the initial release of JVN iPedia on April 25, 2007, is 5,042 and has reached a milestone of 5,000 this quarter. Of those vulnerabilities, 52 are collected from domestic software vendors, 472 are from JVN and 4,518 are from NVD.

Table 1. Vulnerabilities Registered in 2Q

2.1 Severity of Vulnerabilities

JVN iPedia rates and publishes the severity^(*4) of each vulnerability using CVSS^(*5).

Figure 2 shows the annual changes in the severity of vulnerabilities added to JVN iPedia based on the date they were first made public.

So far in 2008, 45 percent of the vulnerabilities are labeled the level III (“High”, CVSS Base Score = 7.0-10.0), 50 percent are the level ll (“Medium”, CVSS Base Score = 4.0-6.9) and 5 percent are the level I (“Low”, CVSS Base Score = 0.0-3.9).

The number of vulnerabilities disclosed has been increasing since 2004 and quite a number of them are rated as dangerous ones. The users need to check out vulnerability information on a daily basis and update the products they use to the latest version or apply security patches.

2.2 Types of Vulnerabilities

Figure 3 shows the annual changes in the types of vulnerabilities added to JVN iPedia based on the date they were first made public.

As shown in the figure below, a number of well-known vulnerabilities, such as buffer overflow (the first buffer overflow vulnerability case on JVN iPedia was published in 1998), lack of access control (the first in 1999) and cross-site scripting (the first in 2000), have been published.

The software developers are advised to refer How to Secure Your Web Site^(*6), which are the security guidelines offered free by IPA, and integrate security in the early stage of design phase of a software development.

2.3 Kinds of Products

Figure 4 shows the annual changes in the kinds of software products registered to JVN iPedia for having vulnerabilities based on the date they were first made public.

The increase in the number of vulnerabilities found in application software in recent years is prominent. The application software includes desktop applications such as Internet Explorer, Mozilla FireFox, Microsoft Office, middle wares such as Web server applications and databases, or development platforms such as PHP, Java and GNU libraries. Many software applications are developed every year, some of which regrettably with vulnerabilities.

The number of vulnerabilities in OS, such as Windows, Mac OS, UNIX and Linux, had been on the raise till about 2005, but the number has been decreasing since then. Vulnerabilities are still found in OS every year but the developers seem to be getting quick to fix them in the subsequent release.

Meanwhile, a new category of embedded software emerged and the vulnerabilities in network devices such as routers and switches, peripheral devices such as printers and hard disks and intelligent home appliances such as cell phones and DVD recorders, have begun appearing.

2.4 Open Source Software

Figure 5 shows the annual changes in vulnerabilities found in open source software (OSS) and non-OSS based on the date they were first made public. 37 percent of the vulnerabilities registered are of OSS and 63 percent are of non-OSS. As for the ratio between OSS and non-OSS, OSS had been on the raise from 1998 to 2003 and marked its highest in 2003, but it has been decreasing since then.

2.5 Product Vendors

Figure 6 and 7 show breakdown of software vendors registered on JVN iPedia. Figure 6 is a breakdown of OSS vendors and Figure 7 of non-OSS vendors.

There are total of 211 OSS vendors, of which 47 are domestic vendors, 20 are oversea vendors with office in Japan, 144 are oversea vendors without office in Japan (Figure 6). For non-OSS vendors, there are total of 144 vendors, of which 87 are domestic vendors, 40 are oversea vendors with office in Japan and 17 are oversea vendors without office in Japan (Figure 7).

As seen in these figures, a number of vulnerabilities have been found in the products developed by the oversea vendors that do not have a Japanese office. When using OSS, if users do not know how to update software to the latest version or apply security patches, they may consider making some arrangements for the support or maintenance service offered by the vendor.

Table 2 is a list of top 20 most accessed vulnerability countermeasure information on JVN iPedia during the second quarter of 2008. The vulnerabilities of pervasively used products, such as Lhaplus, Mozilla Firefox, Adobe Reader/Acrobat, Microsoft Excel and Sun JR, with a high severity score and recently published ones have been accessed most. Table 3 narrows the list to top 5 most accessed vulnerability countermeasure information collected from domestic software developers.

Table 2. Top 20 Most Accessed Vulnerability Countermeasure Information on JVN iPedia

Table 3. Top 5 Most Accessed Vulnerability Countermeasure Information From Domestic Developers

(*1)Japan Vulnerability Notes: a vulnerability information portal operated by IPA and JPCERT/CC ( http://jvn.jp/en/ ). It publishes information on the product developer’s response to the found vulnerabilities and helps users secure their systems.

(*2)National Vulnerability Database: a vulnerability database operated by NIST ( http://nvd.nist.gov/nvd.cfm ).

(*3)National Institute of Standards and Technology: a U.S federal agency that develops and promotes measure-ment, standards and technology ( http://www.nist.gov/ ).

(*4)The article on JVN iPedia’s support of CVSS v2:
http://www.ipa.go.jp/security/vuln/SeverityLevel2.html (in Japanese)

(*5)Introduction to CVSS v2:
http://www.ipa.go.jp/security/vuln/SeverityCVSS2.html (in Japanese)
A Complete Guide to the Common Vulnerability Scoring System Version 2.0:
http://www.first.org/cvss/cvss-guide.html

(*6)How to Secure Your Web Site:
http://www.ipa.go.jp/security/english/vuln/200806_websecurity_en.html

IT Security Center,
Information-technology Promotion Agency, Japan (ISEC/IPA)
E-mail: