IPA/ISEC：Vulnerabilities：JVN iPedia Registration Status for 2009 1Q

1.1 Many well-known types of vulnerability countermeasure information still published

Figure 3 illustrates the number of vulnerability countermeasure information registered during the first quarter, sorted by their type utilizing CWE (Common Weakness Enumeration)^(*4).

The types of vulnerabilities that have a significant number are CWE-399 (Resource Management Errors) with 56 cases, CWE-119 (Buffer Errors) with 37 cases, CWE-264 (Permissions, Privileges, and Access Controls) with 32 cases, CWE-189 (Numeric Errors) with 21 cases, CWE-79 (Cross-site Scripting) with 19 cases, CWE-20 (Insufficient Input Validation) with 15 cases, CWE-200 (Information Leak) with 14 cases, and CWE-94 (Code Injection) with 9 cases.

Most of these are well-known types of vulnerabilities. Software developers should refer to the IPA guidelines that address such vulnerabilities, such as “How to Secure Your Web Site”^(*5) and the “Secure Programming Course”^(*6), to begin the implementation of security measures in the design phase of software development.

1.2 Severity of Vulnerabilities

Figure 4 shows the annual changes in the severity of vulnerabilities added to JVN iPedia based on the date they were first made public by product developers or security portal sites.

The publication of vulnerability countermeasure information has increased dramatically since 2004, and continued to show an increasing tendency through 2008.

JVN iPedia rates each vulnerability according to the CVSS^(*7) and publishes its severity level^(*8).

In 2009, 44 percent of the vulnerabilities were labeled level “High”(CVSS Base Score = 7.0-10.0), 44 percent were labeled level “Medium”(CVSS Base Score = 4.0-6.9) and 12 percent were level “Low”(CVSS Base Score = 0.0-3.9).

Considering the vast number of published vulnerabilities at high severity levels, it is essential for product consumers to check vulnerability information on a daily basis; new versions and security patches concerning the product in question should be employed without delay.

1.3 Kinds of Products

Figure 5 shows the annual changes in the type of software products registered to JVN iPedia for having vulnerabilities, based on their respective publication dates.

Vulnerability countermeasure information is increasingly annually for application software, including desktop applications such as Internet Explorer, Firefox, Microsoft Office, middleware products such as web servers, application servers, databases, and development/management platforms such as PHP, Java, and GNU libraries.

Each year, many new applications are developed and, since they are accompanied by new vulnerabilities, improving security measures concerning application software should be of especially high priority.

Regarding OS such as Windows, Mac OS, UNIX, and Linux, the number of published vulnerability cases initially had had an increasing trend, but the number of cases has dropped off as of 2005.

This is due to the fact that even though new vulnerabilities are discovered each year, vulnerability countermeasures concerning OS are implemented promptly in the subsequent product.

Around the year 2005, vulnerabilities have slowly proceeded to become published concerning embedded software products in intelligent home appliances such as network devices, mobile phones, and DVD recorders.

1.4 Open Source Software

Figure 6 shows the annual changes in JVN iPedia registered vulnerabilities found in open source software (OSS) and non-OSS based on the date they were first made public. 32 percent of the vulnerabilities registered are of OSS and 68 percent are of non-OSS.

From an annual perspective concerning the OSS to non-OSS ratio, OSS had had a successively upward trend from 1998 to 2003, but after marking its highest point in 2003, the ratio of OSS has demonstrated a decreasing trend.

1.5 Product Vendors

Figure 7 and 8 illustrate the breakdown of software vendors registered on JVN iPedia, with Figure 7 a representation of the different OSS vendors, and Figure 8 a representation of non-OSS vendors.

As shown in Figure 7, the registered OSS vendors consist of 54 domestic vendors, 21 foreign vendors with a Japan office, and 176 foreign vendors without an office in Japan; cumulative of 251 vendors.

Similarly, as Figure 8 represents, the 176 registered non-OSS vendors consist of 95 domestic vendors, 48 foreign vendors with an office in Japan, and 33 foreign vendors without an office in Japan.

In terms of OSS vendors, a vast amount of vulnerability countermeasure information is registered from foreign vendors without offices in Japan. When utilizing OSS, if a product user does not have the proper knowledge required to update software to the latest version or to apply security patches, it is necessary to consider contract arrangements for support and/or the use of product support services provided by the vendor.

Table 2 lists the top 20 most accessed vulnerability countermeasure information in the JVN iPedia database during the first quarter of 2009.

Latest vulnerability information concerning frequently used products, such as Becky! Internet Mail, Apache Tomcat, PHP, and products utilizing PHP attracted numerous access counts.

Furthermore, vulnerability countermeasure information where some time has elapsed since the date they were published, such as DNS and virus security, Apache Tomcat, and Lhaplus, attracted high access counts, illustrating user interest in information concerning these products.

Table 3 lists the top 5 vulnerability countermeasure information accessed among the cases provided by domestic product developers.

Table 2. Top 20 Most Accessed Vulnerability Countermeasure Information on JVN iPedia

Table 3. Top 5 Most Accessed Vulnerability Countermeasure Information From Domestic Developers

Note 1) Color Code for CVSS Base Score and Severity Level

Note 2) Color Code for Published Date

(*1)Japan Vulnerability Notes. A portal for vulnerability countermeasure information providing information on vendor response to the reported vulnerabilities and security support. Operated in the collaboration of IPA and JPCERT/CC.
http://jvn.jp/en/

(*2)National Vulnerability Database. A vulnerability database operated by NIST.
http://nvd.nist.gov/home.cfm

(*3)National Institute of Standards and Technology. A U.S federal agency that develops and promotes measurement, standards and technology.
http://www.nist.gov/

(*4)Refer to “CWE (Common Weakness Enumeration) Overview”:
http://www.ipa.go.jp/security/english/vuln/CWE_en.html

(*5)How to Secure Your Web Site:
http://www.ipa.go.jp/security/english/vuln/200806_websecurity_en.html

(*6)Secure Programming Course (in Japanese):
http://www.ipa.go.jp/security/awareness/vendor/programmingv2/index.html

(*7)Common Vulnerability Scoring System (CVSS) v2 Summary:
http://www.ipa.go.jp/security/vuln/SeverityCVSS2.html (in Japanese)
A Complete Guide to the Common Vulnerability Scoring System Version 2.0:
http://www.first.org/cvss/cvss-guide.html (FIRST - Forum of Incident Response and Security Teams)

(*8)Transition to the New Version of Vulnerability Severity Scoring System CVSS v2. CVSS (Common Vulnerability Scoring System).
http://www.ipa.go.jp/security/vuln/SeverityLevel2.html (in Japanese)

• Quarterly Reports of the JVN iPedia Registration Status

IT Security Center,
Information-technology Promotion Agency, Japan (ISEC/IPA)
E-mail: