IPA/ISEC：Vulnerabilities：JVN iPedia Registration Status for 2010 2Q

Some products in each category are reported repeatedly. As for OS, Linux products, such as Red Hat Enterprise Linux and MIRACLE LINUX, and UNIX products like HP-UX, Microsoft Windows and Mac OS are often reported. For Applications, desktop applications, such as Microsoft Office and Mozilla Firefox, Middleware like Oracle Database, and PHP and Java are named as example. Among embedded products, appliance products like routers and switches are often reported. For SCADA, the products of overseas vendors, such as GE-Fanuc, AREVA T&D, Rockwell Automation, are mainly reported.

A lot of vulnerability information on software used in Japan is published on a daily basis. IT users need to check vulnerability information daily and apply product updates and security patches without delay.

MyJVN (http://jvndb.jvn.jp/apis/myjvn/) offered by IPA enables to easily access vulnerability information by vendor name and product name. IPA hopes IT users make use of MyJVN and fix vulnerabilities as soon as possible.

1.3 Most Accessed Vulnerability Countermeasure Information during July 2009 and June 2010

~Check information on old vulnerabilities regularly and make sure your system is free of them~

Table 3 lists the top 20 most accessed vulnerability countermeasure information in the JVN iPedia between July 2009 and June 2010, and Table 4 shows their ranking change by quarter

Among the top 20, the information on 14 vulnerabilities has been updated. Especially, Apache Tomcat (3rd) and Apache HTTP Server (10th) have been updated more than 10 times. In addition, 6 vulnerabilities have been updated after January 2010. The information on SSL and TLS (4th) has been updated on June 17, 2010. Based on the analysis, it seems that the vulnerability information that has been updated many times or updated recently attract access.

Focusing on the vulnerability’s CVSS^(*4) level, only one vulnerability is ranked Level III (High) and most are Level I (Low) and II (Medium). Only 5 vulnerabilities in top 20 of this quarter (April 2010 –June 2010) have been ranked in the top 20 of the last 12 month (July 2009 – June 2010), meaning that the IT users’ interest on the vulnerability information is shifting.

After its initial disclosure, the vulnerability information could be updated to add affected products and/or vendor information. Sometimes, the information on old vulnerabilities is also updated, like Apache Tomcat (3rd) and Apache HTTP Server (10th) in Table 3.

As mentioned above, the information on old vulnerabilities may be updated from time to time. Website and system administrators should check vulnerability information relevant to their IT systems regularly and take proper measures if they find unpatched ones.

Table 3. Top 20 Most Accessed Vulnerability Countermeasure Information in JVN iPedia [Jul. 2009 � Jun. 2010]

Note 1) Color Code for CVSS Base Score and Severity Level

Note 2) Color Code for Published Date

Table 4. Top 20 Most Accessed Vulnerability Countermeasure Information in JVN iPedia [Quarterly Ranking]

2. Summary of 2010 1Q

2.1 Many well-known vulnerabilities still reported

CWE^(*5) is a hierarchically structured list of weakness types to help identifying software vulnerabilities.  CWE enables to identify, analyze and globally compare vulnerabilities that come in a wide variety. Figure 2 illustrates the number of vulnerability countermeasure information registered during 2nd quarter, sorted by their vulnerability type using CWE.

The types of vulnerabilities that have been reported a lot this quarter are CWE-119 (Buffer Errors) with 70 cases, CWE-399 (Resource Management Errors) with 42 cases, CWE-264 (Permissions, Privileges, and Access Controls) with 39 cases, CWE-79 (Cross-Site Scripting) with 30 cases, CWE-94 (Code Injection) with 25 cases, CWE-20 (Insufficient Input Validation) with 23 cases, CWE-189 (Numeric Errors) with 15 cases.

Most of these are well-known types of vulnerabilities. Software developers should refer to the IPA guidelines that address these vulnerabilities, such as “How to Secure Your Web Site”^(*6), “How to Use SQL Calls to Secure Your Web Site ^(*7)” and the “Secure Programming Course”^(*8), to make sure to implement necessary security measures from the planning and design phase of software development.

2.2 Many highly risky vulnerabilities reported

Figure 3 shows the annual transitions in the severity of vulnerabilities registered to JVN iPedia based on the date they were first made public by product developers or other means, like the release on the security portal sites. The publication of vulnerability countermeasure information has increased dramatically since 2004, and continued to show an increasing tendency through 2009.

JVN iPedia rates each vulnerability according to the CVSS^(*4)and publishes its severity level^(*9).

2.3 Vulnerability in application software on the rise

Figure 4 shows the annual transitions in the type of software products registered to JVN iPedia for having vulnerabilities, based on their respective publication dates.

Publication of vulnerability countermeasure information is increasing annually for application software, including desktop applications such as Safari, Internet Explorer, Firefox, Microsoft Office, middleware products such as web servers, application servers, databases, as well as PHP and Java. Since many new applications are developed each year and they are still accompanied by old and new vulnerabilities, improving security measures concerning application software should be of especially high priority.

As for the operating systems such as Windows, Mac OS, UNIX, and Linux, the number of published vulnerabilities initially had had an increasing trend, but the number dropped off as of 2005. This could be due to the fact that even though new vulnerabilities are discovered each year, vulnerability countermeasures concerning OS are implemented promptly in the subsequent product.

Around the year 2005, vulnerabilities in embedded software products like intelligent home appliances, such as network devices, cell phones, and DVD recorders, have slowly proceeded to become published.
In addition, around the year 2008, vulnerabilities in SCADA (Supervisory Control And Data Acquisition) systems used in critical infrastructures have been reported as well. 6 vulnerabilities were published in 2008, 9 in 2009 and 4 in 2010 so far, bringing a total number of reported SCADA vulnerabilities to 19.

2.4 Open Source Software

Figure 5 shows the annual transitions in JVN iPedia registered vulnerabilities found in open source software (OSS) and non-OSS based on the date they were first made public. 34 percent of the vulnerabilities registered are of OSS and 66 percent are of non-OSS. From an annual perspective concerning the OSS to non-OSS ratio, OSS had had a successively upward trend from 1998 to 2003, but after marking its highest point in 2003, the ratio of OSS has demonstrated a decreasing trend.

2.5  Product Vendors

Figure 6 and 7 illustrate the breakdown of software developers (vendors) registered on JVN iPedia, with Figure 6 representing OSS vendors and Figure 7 representing non-OSS vendors.

As shown in Figure 6, the registered OSS vendors consist of 62 domestic vendors, 22 foreign vendors with Japan office, and 221 foreign vendors without office in Japan; cumulative total of 305 OSS vendors. Similarly, as Figure 7 represents, the 212 registered non-OSS vendors consist of 108 domestic vendors, 61 foreign vendors with office in Japan, and 43 foreign vendors without office in Japan.

In the case of OSS vendors, a vast amount of vulnerability countermeasure information registered is from foreign vendors without office in Japan. When using OSS, if product users do not have the proper knowledge required to update software to the latest version or to apply security patches, it is necessary to take contract agreements for support into account and/or the purchase of product support services provided by the vendor.

3. Most Accessed Vulnerability Countermeasure Information

Table 5 lists the top 20 most accessed vulnerability countermeasure information in the JVN iPedia database during the 2nd quarter of 2010 (April – June). Vulnerability countermeasure information where some time has elapsed since the date they were first published, such as that on DNS, OpenSSL, Apache Tomcat, is still gaining a lot of attention. Among the recently released vulnerability information, such as the Ichitaro series, Cybozu, MODx, Cisco Router and Security Device Manager, also attracted a large number of access counts.

Table 6 lists the top 5 vulnerability countermeasure information accessed among those reported by domestic product developers.

Table 5. Top 20 Most Accessed Vulnerability Countermeasure Information in JVN iPedia [Apr. 2010 - Jun. 2010]

Table 6. Top 5 Most Accessed Vulnerability Countermeasure Information from Domestic Developers [Apr. 2010 - Jun. 2010]

Note 1) Color Code for CVSS Base Score and Severity Level

Note 2) Color Code for Published Date

Footnote

(*1)Japan Vulnerability Notes. A portal for vulnerability countermeasure information providing information on vendor response to the reported vulnerabilities and security support. Operated in the collaboration of IPA and JPCERT/CC. 
http://jvn.jp/en/

(*2)National Vulnerability Database. A vulnerability database operated by NIST.
http://nvd.nist.gov/home.cfm

(*3)National Institute of Standards and Technology. A U.S federal agency that develops and promotes measurement, standards and technology.
http://www.nist.gov/

(*4)Common Vulnerability Scoring System (CVSS) v2 Summary:
http://www.ipa.go.jp/security/vuln/SeverityCVSS2.html (in Japanese)

(*5)Refer to “CWE (Common Weakness Enumeration) Overview”
http://www.ipa.go.jp/security/english/vuln/CWE_en.html

(*6)How to Secure Your Web Site:
http://www.ipa.go.jp/security/english/third.html#websecurity

(*7)How to use SQL Calls to Secure Your Web Site:
http://www.ipa.go.jp/security/vuln/websecurity.html (in Japanese)

(*8)Secure Programming Course:
http://www.ipa.go.jp/security/awareness/vendor/programmingv2/index.html (in Japanese)

(*9)Transition to the New Version of Vulnerability Severity Scoring System CVSS v2.
http://www.ipa.go.jp/security/vuln/SeverityLevel2.html (in Japanese)

Reference

Contact