IPA/ISEC：Vulnerabilities：JVN iPedia Registration Status for 2011 3Q

1. 2011 3rd Quarter Vulnerability Countermeasure Information Database JVN iPedia Registration Status (Overview)

The vulnerability countermeasure information database JVN iPedia (http://jvndb.jvn.jp/) is endeavoring to become a comprehensive database where vulnerability countermeasure information for software products used in Japan is gathered and IT users can easily access the information. JVN iPedia has collected and conducted translations on the vulnerability countermeasure information made public by (1) domestic software developers, (2) JVN^(*1), a vulnerability information portal site, and (3) NVD^(*2), a vulnerability information database run by NIST^(*3). JVN iPedia has continued to make these information available to the public since April 25, 2007.

1.1. Vulnerabilities Registered in 2011/3Q

~Vulnerability information stored in JVN iPedia now surpasses 11,000~

Among the vulnerability information registered to the Japanese version of JVN iPedia for the 3rd quarter of 2011 (July 1 to September 30, 2011), those gathered from domestic developers are 3 cases (126 cumulative cases from the launch of JVN iPedia), 124 cases are from JVN (1,365 cumulative cases), and 397 cases from NVD (9,882 cumulative cases), bringing a quarterly total to 524 cases (11,373 cumulative cases). The number of vulnerability information stored on JVN iPedia is now over 11,000 (See Table 1, Figure 1).

The Japanese version of JVN iPedia actively collects vulnerability information about control system software from outside sources like NVD. As of September 30, 2011, 68 cases were stored. Last year, Stuxnet^(*4), a virus targeting industrial control systems, aroused big concern and vulnerabilities in the industrial control systems have been continuously reported. Considering their impact on the social infrastructure, we should pay close attention to vulnerabilities in the industrial control systems.

As for the English version of JVN iPedia, 2 cases were gathered from domestic developers (125 cumulative cases) and 29 from JVN (560 cumulative cases), making a quarterly total to 31 cases (685 cumulative cases).

Table 1. Registered Vulnerabilities in 3rd Quarter of 2011

	Information Source	Registered Cases	Cumulative Cases
Japanese Version	Domestic Product Developers	3 cases	126 cases
	JVN	124 cases	1,365 cases
	NVD	397 cases	9,882 cases
	Total	524 cases	11,373 cases
English Version	Domestic Product Developers	2 cases	125 cases
	JVN	29 cases	560 cases
	Total	31 cases	685 cases

1.2. Hot Topic on the Registered Vulnerability (Topic #1)

~Lots of vulnerabilities in widely-used PC software applications reported. Check up on vulnerability information and update promptly~

The viruses that exploit vulnerability in software applications widely used both in business and private have been causing a serious problem. In particular, as highlighted in the targeted attack^(*5) against a major heavy industries company, cyber attacks^(*6) that target the specific business or person to breach the corporate system and stole classified and personal information have been causing serious damages. JVN iPedia rates each vulnerability according to the CVSS^(*7) and publishes its severity level^(*8). Figure 2 shows the severity of vulnerability in widely-used PC software applications. There are 565 vulnerability information related to Mozilla Firefox and 345 related to Microsoft Internet Explorer. Besides them, there are many other software applications with more than 100 reported vulnerabilities such as Adobe products. When focusing on the severity, 69 percent of the vulnerabilities were labeled level III ("High", CVSS Base Score = 7.0-10.0), 29 percent were labeled level ll ("Medium", CVSS Base Score = 4.0-6.9) and 2 percent were level I ("Low", CVSS Base Score = 0.0-3.9). The most severe, dangerous vulnerabilities account for about 70 percent of the total.

Figure 3 shows the annual transitions in the number of vulnerability information about widely-used PC software applications. The number has been increasing every year. It was 151 in 2007 and it more than tripled in 2010 with 460.

It is essential for IT users to check on vulnerability information on a daily basis, and apply updates or security patches without delay.

1.3. Hot Topic on the Registered Vulnerability (Topic #2)

~Pay attention to vulnerabilities in Products supporting IPv6~

The pool of unallocated IPv4^(*9) addresses has been exhausted and the move to the use of IPv6^(*10) is mandatory. JVN iPedia already stores the information about 71 vulnerabilities in the products that support IPv6, The number of IPv6-related vulnerabilities is expected to increase in the days ahead.

Figure 4 shows the number and severity of IPv6-related vulnerabilities. 50 percent of them were labeled level III ("High", CVSS Base Score = 7.0-10.0), 34 percent were labeled level ll ("Medium", CVSS Base Score = 4.0-6.9) and 10 percent were level I ("Low", CVSS Base Score = 0.0-3.9).

Table 2 shows the High level IPv6-related vulnerabilities stored in JVN iPedia since the year 2009. The vulnerabilities have been found in various products, such as operating systems like Windows, Unix and Linux and routers.

The users of IPv6-supported products should check on vulnerability information on a daily basis, and apply updates or security patches without delay.

Use the TCP/IP Vulnerability Assessment Tool^(*11), a tool that can systematically check the known IPv6 vulnerabilities available from IPA.

Table 2. IPv6-Related Vulnerabilities Stored in JVN iPedia (Since 2009)

#	ID	Title	CVSS Score	Date Public
1	JVNDB-2009-001028	Sun Solaris Kernel DoS Vulnerability	7.8	2009/2/26
2	JVNDB-2009-001350	HP HP-UX IPv6 Neighbor Discovery Protocol (NDP) DoS Vulnerability	9.3	2009/6/30
3	JVNDB-2009-001487	DoS Vulnerability in Cisco IOS Mobile IP NAT Traversal and Mobile IPv6 Subsystem Home Agent (HA) Implementation	7.1	2009/6/30
4	JVNDB-2009-001488	DoS Vulnerability in Cisco IOS Mobile IP NAT Traversal and Mobile IPv6 Subsystem	7.1	2009/6/30
5	JVNDB-2009-002087	Sun Solaris IPv6 Networking Stack DoS Vulnerability	7.1	2009/10/13
6	JVNDB-2010-000031	Microsoft Windows denial of service (DoS) vulnerability	7.8	2010/8/13
7	JVNDB-2010-001087	Vulnerability in Linux Kernel IPv6 jumbogram	7.1	2010/2/26
8	JVNDB-2010-001092	Microsoft Windows TCP/IP Arbitrary Code Execution Vulnerability	10.0	2010/3/1
9	JVNDB-2010-001094	Microsoft Windows TCP/IP Arbitrary Code Execution Vulnerability	10.0	2010/3/1
10	JVNDB-2010-001201	DoS Vulnerability in Linux Kernel the ip6_dst_lookup_tail Function	7.8	2010/4/1
11	JVNDB-2010-001300	DoS Vulnerability in Linux Kernel net/ipv4/tcp_input.c	7.1	2010/4/21
12	JVNDB-2011-001122	Cisco IOS Neighbor Discovery Protocol DoS Vulnerability	7.8	2011/2/24
13	JVNDB-2011-001127	Cisco IOS DoS Vulnerability	7.1	2011/2/25
14	JVNDB-2011-001277	DoS Vulnerability in Cisco Adaptive Security Appliances and Cisco PIX Security Appliances	7.8	2011/3/24

Note 1) Color Code for CVSS Base Score and Severity Level

CVSS Base Score = 0.0～3.9 Severity Level = I (Low)

CVSS Base Score = 4.0～6.9 Severity Level = II (Medium)

CVSS Base Score = 7.0～10.0 Severity Level = III (High)

Note 2) Color Code for Published Date

Published in 2009 and before

Published in 2010

Published in 2011

2. 2011 3rd Quarter Vulnerability Countermeasure Information Database JVN iPedia Registration Status (Details)

2.1. Summary of 2011/3Q

2.1.1 Type of vulnerabilities reregistered in 2011 3Q

CWE^(*12) is a hierarchically structured list of weakness types to help identifying software vulnerabilities. CWE enables to identify, analyze and globally compare vulnerabilities that come in a wide variety. Figure 5 illustrates the number of vulnerability countermeasure information registered during the 3rd quarter, sorted by their vulnerability type using CWE.

The types of vulnerabilities that have been reported a lot this quarter are CWE-119 (Buffer Errors) with 115 cases, CWE-399 (Resource Management Errors) with 53 cases, CWE-20 (Improper Input Validation) with 46 cases, CWE-79 (Cross-Site Scripting) with 42 cases, CWE-264 (Permissions, Privileges, and Access Controls) with 32 cases, CWE-189 (Numeric Errors) with 23 cases and CWE-200 (Information Leak) with 20 cases.

Most of these are well-known types of vulnerabilities. Software developers should refer to the IPA guidelines that address these vulnerabilities, such as the "Secure Programming Course"^(*13), to make sure to implement necessary security measures from the planning and design phase of software development. A hands-on vulnerability learning and experiencing tool "AppGoat^(*14)" is also effective to learn about vulnerability.

2.1.2 Annual proportion of severity of vulnerabilities

Figure 6 shows the annual transitions in the severity of vulnerabilities registered to JVN iPedia based on the date they were first made public by product developers or through other means, like the release on the security portal sites. Since 2008, the publication of the vulnerabilities that were labeled level III ("High", CVSS Base Score = 7.0-10.0) has been on the rise and it was over 50 percent in 2010.

As of September 30, 2011, 47 percent of the vulnerabilities were labeled level III ("High", CVSS Base Score = 7.0-10.0), 45 percent were labeled level ll ("Medium", CVSS Base Score = 4.0-6.9) and 8 percent were level I ("Low", CVSS Base Score = 0.0-3.9).

Considering the vast number of published vulnerabilities is being labeled with the higher severity levels, it is essential for IT users to check on vulnerability information on a daily basis, and apply updates or security patches without delay.

2.1.3 Type of products reported for having vulnerability

Figure 7 shows the annual transitions in the type of software products registered to JVN iPedia for having vulnerabilities, based on their respective publication date. Publication of vulnerability information about applications has been increasing every year. It was 145 in 2003 and it was more than tenfold higher in 2010 with 1,629.

Since about 2008, the vulnerabilities in the industrial control systems (SCADA: Supervisory Control And Data Acquisition) used in critical infrastructures have been also reported. 8 in 2008, 10 in 2009, 4 in 2010 and 36 in 2011 - the total of 68 SCADA vulnerabilities are stored in JVN iPedia.

Since many new applications are developed each year with old and new vulnerabilities, improving application security is getting more and more important. It is essential for IT users to check on vulnerability information on a daily basis, and apply updates or security patches without delay.

2.1.4 Open Source Software

Figure 8 shows the annual transitions in JVN iPedia registered vulnerabilities found in open source software (OSS) and non-OSS based on the date they were first made public. Since 2008, the ratio of OSS has demonstrated a decreasing trend and it is 26 percent in 2011. In total, 32 percent of the vulnerabilities registered are of OSS and 68 percent are of non-OSS.

2.1.5 Product Vendors

Figure 9 and 10 illustrate the breakdown of OSS and non-OSS software developers (vendors) registered on JVN iPedia, with Figure 9 representing OSS vendors and Figure 10 representing non-OSS vendors.

As shown in Figure 9, the registered OSS vendors consist of 67 domestic vendors, 27 foreign vendors with Japan office, and 256 foreign vendors without office in Japan; a cumulative total of 350 OSS vendors. Similarly, as Figure 10 represents, the total of 295 registered non-OSS vendors consist of 124 domestic vendors, 84 foreign vendors with office in Japan, and 87 foreign vendors without office in Japan.

In the case of OSS vendors, a vast amount of vulnerability countermeasure information registered is from foreign vendors without office in Japan. When using OSS, if product users do not have the proper knowledge required to update software to the latest version or to apply security patches, it is necessary to take contract agreements for support into account and/or the purchase of product support services provided by the vendor.

2.2. Most Accessed Vulnerability Countermeasure Information

JVN iPedia has a hit count of 20,090,000 during October 2010 to September 2011, with the monthly average of 1.7 million.

Table 3 lists the top 20 most accessed vulnerability countermeasure information in the JVN iPedia database during the 3rd quarter of 2011 (July - September). Among 20, 15 are the vulnerabilities released on JVN.

Table 4 lists the top 5 vulnerability countermeasure information accessed among those reported by domestic product developers.

Table 3. Top 20 Most Accessed Vulnerability Countermeasure Information in JVN iPedia [Jul. 2011 - Sep. 2011]

#	ID	Title	Access Counts	CVSS Score	Date Public
1	JVNDB-2011-002172	Apache HTTPD Server DoS Vulnerability	2422	7.8	2011/9/1
2	JVNDB-2011-000053	Android vulnerability where an incorrect SSL certificate is displayed	1507	4.3	2011/7/29
3	JVNDB-2011-000060	Windows URL Protocol Handler may insecurely load executable files	1121	6.8	2011/8/10
4	JVNDB-2011-000052	Internet Explorer vulnerable to cross-site scripting	1046	2.6	2011/7/8
5	JVNDB-2011-000051	ASP.NET vulnerable to cross-site scripting	908	4.3	2011/7/15
6	JVNDB-2011-000048	ALZip vulnerable to buffer overflow	858	6.8	2011/6/29
7	JVNDB-2010-001740	Apache Tomcat Information Disclosure Vulnerability (Japanese)	847	6.4	2010/7/29
8	JVNDB-2011-000059	Mozilla Firefox vulnerable to cross-site scripting	809	2.6	2011/7/28
9	JVNDB-2011-000064	Microsoft Windows XP vulnerable to denial-of-service (DoS)	779	4.3	2011/8/19
10	JVNDB-2011-000054	Google Search Appliance vulnerable to cross-site scripting	728	4.3	2011/7/15
11	JVNDB-2011-000061	Internet Explorer window display vulnerability	724	4.3	2011/8/12
12	JVNDB-2011-000050	XnView may insecurely load executable files	723	5.1	2011/7/5
13	JVNDB-2009-002319	SSL and TLS protocols renegotiation vulnerability (Japanese)	717	6.4	2009/12/14
14	JVNDB-2011-000056	Plone vulnerable to cross-site scripting	673	2.6	2011/7/27
15	JVNDB-2011-001930	Apache Tomcat Access Control Bypass Vulnerability	668	4.4	2011/7/26
16	JVNDB-2011-000063	Aipo vulnerable to SQL injection	667	6.5	2011/8/16
17	JVNDB-2011-000049	Opera vulnerable to denial-of-service (DoS)	659	4.3	2011/7/5
18	JVNDB-2011-000035	Java Web Start may insecurely load dynamic libraries	629	6.8	2011/6/10
19	JVNDB-2011-000043	Ichitaro series vulnerable to arbitrary code execution	610	9.3	2011/6/16
20	JVNDB-2007-001017	Improper HTTP method examination for Apache HTTP Server 413 error message (Japanese)	603	4.3	2007/12/20

Table 4. Top 5 Most Accessed Vulnerability Countermeasure Information from Domestic Developers [Jul. 2011 - Sep. 2011]

#	ID	Title	Access Counts	CVSS Score	Date Public
1	JVNDB-2011-001928	JP1/Performance Management - Web Console Cross-Site Scripting Vulnerability	383	4.3	2011/7/26
2	JVNDB-2011-001927	Arbitrary Code Execution Vulnerability in HiRDB Control Manager	383	10.0	2011/7/26
3	JVNDB-2010-002808	Accela BizSearch Standard Search Page Cross-Site Scripting Vulnerability	363	4.3	2011/5/26
4	JVNDB-2010-002807	Accela BizSearch Standard Search Page Cross-Site Scripting Vulnerability	326	4.3	2011/5/26
5	JVNDB-2011-001633	Header Customization by Hitachi Web Server RequetHeader Directive Could Allow Attacker to Access Data Deleted from Memory	312	5.1	2011/5/26

Note 1) Color Code for CVSS Base Score and Severity Level

CVSS Base Score = 0.0～3.9 Severity Level = I (Low)

CVSS Base Score = 4.0～6.9 Severity Level = II (Medium)

CVSS Base Score = 7.0～10.0 Severity Level = III (High)

Note 2) Color Code for Published Date

Published in 2009 and before

Published in 2010

Published in 2011

Footnote

Reference

Contact