IPA/ISEC：Vulnerabilities：JVN iPedia Registration Status for 2011 2Q

1. 2011 2nd Quarter Vulnerability Countermeasure Information Database JVN iPedia Registration Status (Overview)

The vulnerability countermeasure information database JVN iPedia (http://jvndb.jvn.jp/) is endeavoring to become a comprehensive database where vulnerability countermeasure information for software products used in Japan is gathered and IT users can easily access the information. JVN iPedia has collected and conducted translations on the vulnerability countermeasure information made public by (1) domestic software developers, (2) JVN^(*1), a vulnerability information portal site, and (3) NVD^(*2), a vulnerability information database run by NIST^(*3). JVN iPedia has continued to make these information available to the public since April 25, 2007.

1.1. Vulnerabilities Registered in 2011/2Q

~Vulnerability information stored in JVN iPedia now surpasses 10,800~

Among the vulnerability information registered to the Japanese version of JVN iPedia for the 2nd quarter of 2011 (April 1 to June 30, 2011), those gathered from domestic developers are 5 cases (123 cumulative cases from the launch of JVN iPedia), 125 cases are from JVN (1,241 cumulative cases), and 508 cases from NVD (9,485 cumulative cases), bringing a quarterly total to 638 cases (10,849 cumulative cases). The number of vulnerability information stored on JVN iPedia is now over 10,800 (See Table 1, Figure 1).

The Japanese version of JVN iPedia actively collects vulnerability information about control system software from outside sources like NVD. In the first half of 2011 (January 1 to June 30, 2011), 22 cases were collected. Last year, Stuxnet^(*4), a virus targeting a control system, aroused big concern. Even after that, vulnerabilities in the control systems have been frequently reported. Considering the impact on the social infrastructure, vulnerabilities in the control systems should be watched out carefully.

As for the English version of JVN iPedia, 6 case was gathered from domestic developers (123 cumulative cases) and 26 from JVN (531 cumulative cases), making a quarterly total to 32 cases (654 cumulative cases).

Table 1. Registered Vulnerabilities in 2nd Quarter of 2011

	Information Source	Registered Cases	Cumulative Cases
Japanese Version	Domestic Product Developers	5 cases	123 cases
	JVN	125 cases	1,241 cases
	NVD	508 cases	9,485 cases
	Total	638 cases	10,849 cases
English Version	Domestic Product Developers	6 cases	123 cases
	JVN	26 cases	531 cases
	Total	32 cases	654 cases

1.2. Hot Topic on the Registered Vulnerability (Topic #1)

~Lots of vulnerabilities in web service software. Check up the vulnerability information and update promptly~

Attacks exploiting vulnerability in the systems that offer web services via the Internet have been done frequently in Japan and overseas. An information leakage of more than 100 million people's personal information a few months ago has attracted a great social attention.

A common web service system has a design of three-layered applications (web server, web application server and database server). JVN iPedia stores a lot of vulnerability information on software for hose server applications.

Figure 2 shows the annual transitions in the number of vulnerability information about the web service's three-layered applications registered to JVN iPedia, based on their respective publication date. In 2006, the number of vulnerabilities in database server and web application server software almost doubled the previous year and stays around 200 since then.

Figure 3, 4 and 5 show the number and severity of vulnerabilities in software for the web service's three-layered applications. JVN iPedia rates each vulnerability according to the CVSS^(*5) and publishes its severity level^(*6).

Figure 3 shows the number and severity of vulnerability in web server software. Among the total of 305 reported cases, Apache HTTP server accounts for 35 percent (106 cases). When focusing on the severity, 32 percent of the vulnerabilities were labeled level III ("High", CVSS Base Score = 7.0-10.0), 67 percent were labeled level ll ("Medium", CVSS Base Score = 4.0-6.9) and 1 percent were level I ("Low", CVSS Base Score = 0.0-3.9).

Figure 4 shows the number and severity of vulnerability in web application server software. Among the total of 511 reported cases, Oracle Application Server and IBM WebSphere Application Server account for 74 percent (376 cases). When focusing on the severity, 40 percent of the vulnerabilities were labeled level III ("High", CVSS Base Score = 7.0-10.0), 52 percent were labeled level ll ("Medium", CVSS Base Score = 4.0-6.9) and 8 percent were level I ("Low", CVSS Base Score = 0.0-3.9).

Figure 5 shows the number and severity of vulnerability in database server software. Among the total of 561 reported cases, Oracle Database accounts for 59 percent (331 cases). When focusing on the severity, 40 percent of the vulnerabilities were labeled level III ("High", CVSS Base Score = 7.0-10.0), 50 percent were labeled level ll ("Medium", CVSS Base Score = 4.0-6.9) and 10 percent were level I ("Low", CVSS Base Score = 0.0-3.9).

In recent days, attacks exploiting vulnerabilities in the web service system have been causing a number of information leakage incidents. Server administrators should check on the vulnerability information on server software and update without delay.

 

1.3. Hot Topic on the Registered Vulnerability (Topic #2)

~Reports on vulnerabilities in Adobe Flash Player surged~

JVN iPedia stores the total of 182 cases of Adobe Flash Player's vulnerability information. 95 of them are highly severe vulnerabilities and could install malicious programs, alter or delete data by just accessing a compromised web page. Figure 6 shows the number and severity of vulnerabilities in Adobe Flash Player. The number is on the rise year after year. When focusing on the severity, 73 percent of the vulnerabilities were labeled level III ("High", CVSS Base Score = 7.0-10.0), 12 percent were labeled level ll ("Medium", CVSS Base Score = 4.0-6.9) and 15 percent were level I ("Low", CVSS Base Score = 0.0-3.9). As just shown in numbers, a lot of highly serious vulnerabilities have been reported.

Figure 7 shows the quarterly transition in the number of security updates for Adobe Flash Player. As the number of highly severe vulnerabilities increases, so does the number of security updates.

Until the 1st quarter of the year 2011 (January 1 to March 31, 2011), the number of updates released per quarter was around 2, but it doubled this quarter to 4.

This circumstance tells that IT users must check on the vulnerability information frequently and update software promptly. IPA offers a free tool "MyJVN Version Checker" that enables IT users to easily check if software applications installed in their PC are the latest version. Use the tools like MyJVN Version Checker proactively and keep the software up-to-date and vulnerability-free.

2. 2011 2nd Quarter Vulnerability Countermeasure Information Database JVN iPedia Registration Status (Details)

2.1. Summary of 2011/2Q

2.1.1 Type of vulnerabilities reregistered in 2011 2Q

CWE^(*7) is a hierarchically structured list of weakness types to help identifying software vulnerabilities. CWE enables to identify, analyze and globally compare vulnerabilities that come in a wide variety. Figure 8 illustrates the number of vulnerability countermeasure information registered during the 2nd quarter, sorted by their vulnerability type using CWE.

The types of vulnerabilities that have been reported a lot this quarter are CWE-119 (Buffer Errors) with 106 cases, CWE-399 (Resource Management Errors) with 72 cases, CWE-20 (Improper Input Validation) with 57 cases, CWE-264 (Permissions, Privileges, and Access Controls) with 34 cases, CWE-189 (Numeric Errors) with 32 cases, CWE-79 (Cross-Site Scripting) with 27 cases and CWE-200 (Information Leak) with 16 cases.

Most of these are well-known types of vulnerabilities. Software developers should refer to the IPA guidelines that address these vulnerabilities, such as the "Secure Programming Course"^(*8), to make sure to implement necessary security measures from the planning and design phase of software development. A hands-on vulnerability learning and experiencing tool "AppGoat^(*9)" is also effective to learn about vulnerability.

2.1.2 Annual proportion of severity of vulnerabilities

Figure 9 shows the annual transitions in the severity of vulnerabilities registered to JVN iPedia based on the date they were first made public by product developers and other means, like the release on the security portal sites. Since 2008, the publication of the vulnerabilities that were labeled level III ("High", CVSS Base Score = 7.0-10.0) has been on the rise and it was 50 percent in 2010 and is more than 52 percent in 2011.

As of June 30, 2011, 47 percent of the vulnerabilities were labeled level III ("High", CVSS Base Score = 7.0-10.0), 45 percent were labeled level ll ("Medium", CVSS Base Score = 4.0-6.9) and 8 percent were level I ("Low", CVSS Base Score = 0.0-3.9).

Considering the vast number of published vulnerabilities is being labeled with the higher severity levels, it is essential for IT users to check on vulnerability information on a daily basis, and apply updates or security patches concerning the products in use without delay.

2.1.3 Type of products reported for having vulnerability

Figure 10 shows the annual transitions in the type of software products registered to JVN iPedia for having vulnerabilities, based on their respective publication date.

Publication of vulnerability information is increasing year by year for application software, including desktop applications such as Adobe Reader, Adobe Flash Player, Safari, Internet Explorer, Firefox, middleware such as web servers, application servers, databases, and application development languages such as PHP and Java. Since many new applications are developed each year with old and new vulnerabilities, improving application security is getting more and more important. It is essential for IT users to check on vulnerability information on a daily basis, and apply updates or security patches concerning the products in use without delay.

2.1.4 Open Source Software

Figure 11 shows the annual transitions in JVN iPedia registered vulnerabilities found in open source software (OSS) and non-OSS based on the date they were first made public. Since 2008, the ratio of OSS has demonstrated a decreasing trend and it is 20 percent in 2011 alone. In total, 32 percent of the vulnerabilities registered are of OSS and 68 percent are of non-OSS.

2.1.5 Product Vendors

Figure 12 and 13 illustrate the breakdown of OSS and non-OSS software developers (vendors) registered on JVN iPedia, with Figure 12 representing OSS vendors and Figure 13 representing non-OSS vendors.

As shown in Figure 12, the registered OSS vendors consist of 66 domestic vendors, 24 foreign vendors with Japan office, and 245 foreign vendors without office in Japan; a cumulative total of 335 OSS vendors. Similarly, as Figure 13 represents, the total of 266 registered non-OSS vendors consist of 123 domestic vendors, 78 foreign vendors with office in Japan, and 65 foreign vendors without office in Japan.

In the case of OSS vendors, a vast amount of vulnerability countermeasure information registered is from foreign vendors without office in Japan. When using OSS, if product users do not have the proper knowledge required to update software to the latest version or to apply security patches, it is necessary to take contract agreements for support into account and/or the purchase of product support services provided by the vendor.

2.2. Most Accessed Vulnerability Countermeasure Information

JVN iPedia has a hit count of 16,430,000 during July 2010 to June 2011, with the monthly average of 1.4 million.

Table 2 lists the top 20 most accessed vulnerability countermeasure information in the JVN iPedia database during the 2nd quarter of 2011 (April � June). Among 20, 14 are the vulnerabilities released on JVN.

Table 3 lists the top 5 vulnerability countermeasure information accessed among those reported by domestic product developers.

Table 2. Top 20 Most Accessed Vulnerability Countermeasure Information in JVN iPedia [Apr. 2011 � Jun. 2011]

#	ID	Title	Access Counts	CVSS Score	Date Public
1	JVNDB-2009-002319	SSL and TLS protocols renegotiation vulnerability (in Japanese)	1014	6.4	2009/12/14
2	JVNDB-2011-000031	Movable Type vulnerable to cross-site scripting	958	5.0	2011/5/25
3	JVNDB-2011-000030	iVIEW Suite vulnerable to SQL injection	783	7.5	2011/5/19
4	JVNDB-2011-000033	Java Web Start may insecurely load policy files	779	6.8	2011/6/10
5	JVNDB-2009-000061	Third-party cookie issue in Opera	754	2.6	2009/9/17
6	JVNDB-2011-000023	Password Vault Web Access vulnerable to cross-site scripting	722	4.0	2011/4/8
7	JVNDB-2011-000029	EC-CUBE vulnerable to cross-site request forgery	710	2.6	2011/5/10
8	JVNDB-2011-000028	Virus Buster 2009 key input encryption function vulnerability	675	2.1	2011/5/17
9	JVNDB-2011-000024	Multiple Yamaha routers vulnerable to denial-of-service (DoS)	640	7.8	2011/5/10
10	JVNDB-2011-000022	Picasa may insecurely load executable files	637	5.1	2011/3/25
11	JVNDB-2011-001185	Vulnerability in Java Runtime Environment Component of Multiple Oracle Products (in Japanese)	625	5.0	2011/3/8
12	JVNDB-2010-001740	Apache Tomcat Information Disclosure Vulnerability (in Japanese)	594	6.4	2010/7/29
13	JVNDB-2011-000043	Ichitaro series vulnerable to arbitrary code execution	569	9.3	2011/6/16
14	JVNDB-2011-000035	Java Web Start may insecurely load dynamic libraries	564	6.8	2011/6/10
15	JVNDB-2008-001043	X.Org Foundation X server buffer overflow vulnerability	560	7.4	2008/1/31
16	JVNDB-2011-000026	Applications that use the Windows Help function may be vulnerable to privilege escalation	549	7.2	2011/5/11
17	JVNDB-2011-000027	La Fonera+ vulnerable to denial-of-service (DoS)	533	6.1	2011/5/11
18	JVNDB-2007-001017	Improper HTTP method examination for Apache HTTP Server 413 error message (in Japanese)	521	4.3	2007/12/20
19	JVNDB-2010-002548	OpenSSL Ciphersuite Downgrade Attack (in Japanese)	508	4.3	2010/12/24
20	JVNDB-2011-000025	Multiple Buffalo routers vulnerable to cross-site request forgery	504	4.0	2011/5/10

Table 3. Top 5 Most Accessed Vulnerability Countermeasure Information from Domestic Developers [Apr. 2011 - Jun. 2011]

#	ID	Title	Access Counts	CVSS Score	Date Public
1	JVNDB-2011-001145	JP1/NETM/DM Denial of Service (DoS) Vulnerability	305	5.0	2011/3/1
2	JVNDB-2008-001313	JP1/Cm2/Network Node Manager Denial of Service Vulnerability	278	5.0	2008/5/9
3	JVNDB-2008-001150	JP1/HIBUN Encryption/Decryption and Removable Media Control Malfunction Problems	278	3.6	2008/3/14
4	JVNDB-2008-001895	JP1/VERITAS NetBackup JAVA Administration GUI Privilege Escalation Vulnerability	263	6.5	2008/11/26
5	JVNDB-2008-001647	Jasmine WebLink Template Multiple Vulnerabilities	252	7.5	2008/9/10

Note 1) Color Code for CVSS Base Score and Severity Level

CVSS Base Score = 0.0～3.9 Severity Level = I (Low)

CVSS Base Score = 4.0～6.9 Severity Level = II (Medium)

CVSS Base Score = 7.0～10.0 Severity Level = III (High)

Note 2) Color Code for Published Date

Published in 2009 and before

Published in 2010

Published in 2011

Footnote

Reference

Contact