HOMEIT SecurityMeasures for Information Security VulnerabilitiesQuarterly ReportsVulnerability Countermeasure Information Database JVN iPedia Registration Status [2016 2nd Quarter (Apr. - Jun.)]
Augst 15, 2016
IT Security Center
The vulnerability countermeasure information database JVN iPedia (http://jvndb.jvn.jp/en/) is endeavoring to become a comprehensive database where vulnerability countermeasure information about software used in Japan is aggregated for IT users to easily access the information. JVN iPedia collects and/or translates the vulnerability countermeasure information published by 1) domestic software developers, 2) JVN (*1), a vulnerability information portal run by IPA and JPCERT/CC, and 3) NVD (*2), a vulnerability information database run by NIST (*3). JVN iPedia has continued to make the vulnerability information available to the public since April 25, 2007.
~ JVN iPedia now covers more than 60,000 vulnerabilities ~
The summary of the vulnerability information registered to the Japanese version of JVN iPedia during the 2nd quarter of 2016 (April 1 to June 30, 2016) is shown in the table below. As of the end of June 2016, the total number of vulnerabilities stored in JVN iPedia is 61,309 (Table 1-1, Figure 1-1).
As for the English version, the total of 1,458 vulnerabilities are available as shown in the lower half of the table.
| Information Source | Registered Cases | Cumulative Cases | |
|---|---|---|---|
| Japanese Version | Domestic Product Developers | 2 cases | 176 cases |
| JVN | 206 cases | 6,498 cases | |
| NVD | 1,554 cases | 54,635 cases | |
| Total | 1,762 cases | 61,309 cases | |
| English Version | Domestic Product Developers | 2 cases | 176 cases |
| JVN | 84 cases | 1,282 cases | |
| Total | 86 cases | 1,458 cases |
~ Exploit codes publically available for 2 out of 15 vulnerabilities disclosed during this quarter ~
During April to June, a dozen of vulnerabilities in Apache Struts have been reported. Apache Struts is an open source software framework for developing Java web applications. Because exploit codes that specifically target those vulnerabilities are publically available and remote attackers could execute arbitrary code, IPA issued an emergency security alert in April and June to warn people to stay alert (*4)(*5).
As shown in the Table 1-2, 15 vulnerabilities have been registered to JVN iPedia this quarter, including JVNDB-2016-002626 and JVNDB-2016-000110 that prompted IPA to issue emergency security alerts. Among 15 vulnerabilities, 2 of them affect Apache Struts 1 and the rest affects Apache Struts 2.
| No | ID (CVE) | Title | Affected Systems (Apache Struts Only) | JVN iPedia Date Public |
|---|---|---|---|---|
| 1 | JVNDB-2016-002004 (CVE-2016-4003) |
Cross-site scripting vulnerability in the URLDecoder function in JRE used in Apache Struts | 2.x before 2.3.28 (JRE before 1.8) |
2016/4/13 |
| 2 | JVNDB-2016-002075 (CVE-2016-0785) |
Apache Struts vulnerable to arbitrary code execution | 2.x before 2.3.28 | 2016/4/18 |
| 3 | JVNDB-2016-002076 (CVE-2016-2162) |
Apache Struts vulnerable to Cross-site scripting | 2.x before 2.3.28 | 2016/4/18 |
| 4 | JVNDB-2016-002326 (CVE-2016-3081) |
Apache Struts 2 vulnerable to remote code execution (Emergency Security Alert issued) |
2.3.20 through 2.3.28 (except 2.3.20.3 and 2.3.24.3) |
2016/4/28 |
| 5 | JVNDB-2016-002406 (CVE-2016-3082) |
Arbitrary code execution vulnerability in XSLTResult in Apache Struts | 2.x before 2.3.20.2 2.3.24.x before 2.3.24.2 2.3.28.x before 2.3.28.1 |
2016/5/6 |
| 6 | JVNDB-2016-000096 (CVE-2016-1181) |
Apache Struts 1 vulnerability that allows unintended remote operations against components on memory | 1.0 through 1.3.10 | 2016/6/7 |
| 7 | JVNDB-2016-000097 (CVE-2016-1182) |
Apache Struts 1 vulnerable to input validation bypass | 1.1 through 1.3.10 | 2016/6/7 |
| 8 | JVNDB-2016-003040 (CVE-2016-3087) |
Apache Struts vulnerable to arbitrary code execution | 2.3.20.x before 2.3.20.3 2.3.24.x before 2.3.24.3 2.3.28.x before 2.3.28.1 |
2016/6/10 |
| 9 | JVNDB-2016-003041 (CVE-2016-3093) |
Apache Struts vulnerable to denial-of-service (DoS) | 2.0.0 through 2.3.24.1 | 2016/6/10 |
| 10 | JVNDB-2016-000110 (CVE-2016-4438) |
Apache Struts vulnerable to remote code execution (Emergency Security Alert issued) |
2.3.20 through 2.3.28.1 | 2016/6/20 |
| 11 | JVNDB-2016-000111 (CVE-2016-4430) |
Apache Struts vulnerable to cross-site request forgery | 2.3.20 through 2.3.28.1 | 2016/6/20 |
| 12 | JVNDB-2016-000112 (CVE-2016-4433) |
Apache Struts vulnerable to validation bypass in Getter method | 2.3.20 through 2.3.28.1 | 2016/6/20 |
| 13 | JVNDB-2016-000113 (CVE-2016-4431) |
Apache Struts vulnerable to input validation bypass | 2.3.20 through 2.3.28.1 | 2016/6/20 |
| 14 | JVNDB-2016-000114 (CVE-2016-4465) |
Apache Struts vulnerable to denial-of-service (DoS) | 2.3.20 through 2.3.28.1 2.5 |
2016/6/20 |
| 15 | JVNDB-2016-000121 (CVE-2016-3092) |
Apache Commons FileUpload vulnerable to denial-of-service (DoS) | 2.5.1 and earlier | 2016/6/30 |
The reason why Apache Struts 1 vulnerabilities are less disclosed is because Apache Struts 1 reached end-of-support in April 2013. Although two Apache Struts 1 vulnerabilities (CVE-2016-1181 and CVE-2016-1182) were disclosed as exceptions, basically newly found vulnerabilities in end-of-support software are not disclosed nor fixed. Thus, it is unknown whether vulnerabilities newly found in Apache Struts 2 would also affect Apache Struts 1. If they would, they might allow an attacker to cause a denial of service (DoS) condition or execute arbitrary code on the affected system.
Regardless of its end-of-support status, Apache Struts 1 has still been used in enterprise systems. Apache Struts 1 users and system administrators need to consider migrating to Apache Struts 2 or another framework supported by vendor. Even if using supported products, check vulnerability information and make sure to keep them up to date.
Figure 2-1 shows the number of vulnerabilities newly added to JVN iPedia during the 2nd quarter of 2016, sorted by the CWE vulnerability types.
The type of the vulnerabilities reported most in the 2nd quarter is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) with 353 cases, followed by CWE-20 (Improper Input Validation) with 176 cases, CWE-264 (Permissions, Privileges and Access Controls with 170 cases CWE-200 (Information Exposure) with 165, CWE-79 (Cross-Site Scripting) with 96. CWE-119, the most reported vulnerability type this quarter, could allow an attacker to execute arbitrary code on the affected server or PC, causing various undesirable consequences, such as unauthorized access to and/or alteration of data.
Software developers need to make sure to implement necessary security measures from the planning and design phase of software development to mitigate vulnerability. IPA provides tools and guidelines, such as "How to Secure Your Website" (*6) for website developers and operators to create a secure website and "AppGoat" (*7) to help learn and understand vulnerability through hands-on practice and exercise.
Figure 2-2 shows the annual change in the severity of vulnerabilities registered to JVN iPedia based on the date they were first published.
As of the end of June 2016, 40.1 percent of all vulnerabilities registered since the launch of JVN iPedia are level III (“High”, CVSS Base Score = 7.0-10.0), 52.5 percent are level ll (“Medium”, CVSS Base Score = 4.0-6.9), and 7.4 percent are level I (“Low”, CVSS Base Score = 0.0-3.9).
This means the severity of about 93 percent of the known vulnerabilities is level II or higher, which is critical enough to cause information exposure or data modification. To avoid threats imposed by the known vulnerabilities, it is essential for users to update software to the latest version or apply security patches as soon as possible when they become available.
In addition to a CVSSv2 severity score, JVN iPedia has started a pilot to provide a CVSSv3 severity score since December 1, 2015.
Figure 2-3 shows the annual change in the type of software reported with vulnerability. Application vulnerabilities have been disclosed most, accounting for 72.3 percent of the total.
Since 2007, vulnerability in industrial control systems (ICS) used in critical infrastructure sectors has started to be added to JVN iPedia. As of 2016/2Q, the total of 882 ICS vulnerabilities have been registered (Figure 2-4).
Table 2-4 lists the top 20 software whose vulnerabilities were most registered during the 2nd quarter (April to June) of 2016. 13 out of 20 are operating systems, accounting for more than 60 percent. Apart from operating systems, Adobe Systems products, such as Adobe Flash Player and Adobe Reader, stand out.
JVN iPedia stores vulnerability information on a variety of software, including operating systems ranked in the top 20. IPA hopes users and developerss will make use of JVN iPedia to efficiently check vulnerability information about the software they are using and take necessary action timely (*8).
| Rank | Category | Product Name (Vendor) | Number of Vulnerability Registered |
|---|---|---|---|
| 1 | Browser | Google Chrome (Google) | 147 |
| 2 | OS | Microsoft Windows 10 (Microsoft) | 120 |
| 2 | OS | Microsoft Windows Server 2012 (Microsoft) | 120 |
| 4 | OS | Microsoft Windows 8.1 (Microsoft) | 118 |
| 5 | OS | Debian GNU/Linux (Debian) | 116 |
| 6 | OS | Android (Google) | 107 |
| 7 | OS | Linux Kernel (kerner.org) | 102 |
| 8 | OS | Microsoft Windows RT 8.1 (Microsoft) | 99 |
| 9 | PDF Viewer | Adobe Acrobat Reader DC (Adobe Systems) | 93 |
| 9 | PDF Viewer | Adobe Reader (Adobe Systems) | 93 |
| 9 | PDF Viewer/Editor | Adobe Acrobat (Adobe Systems) | 93 |
| 9 | PDF Viewer/Editor | Adobe Acrobat DC (Adobe Systems) | 93 |
| 9 | Media Player | Adobe Flash Player (Adobe Systems) | 93 |
| 14 | OS | Apple Mac OS X (Apple) | 72 |
| 15 | Script Language | PHP (The PHP Group) | 53 |
| 16 | OS | Ubuntu (Canonical) | 50 |
| 17 | OS | openSUSE (openSUSE project) | 45 |
| 18 | OS | iOS (Apple) | 42 |
| 19 | OS | tvOS (Apple) | 33 |
| 20 | OS | Microsoft Windows Server 2008 (Microsoft) | 32 |
Table 3-1 lists the top 20 most accessed vulnerability information in JVN iPedia during the 2nd quarter of 2016 (April – June).
The 1st, 3rd, 4th, and 5th are Apache Struts vulnerabilities. They have gathered a lot of attention probably because it is widely used to develop web applications. Since exploit code of the 5th vulnerability was also made public, IPA has issued an emergency security alert. The 2nd, 12th, 14th, 15th and 19th are vulnerabilities in OpenSSL used for encrypting communications. The 6th is a vulnerability in an image editor ImageMagick. The vulnerability is also known as ImageTragick and has drawn attention.
Table 3-2 lists the top 5 most accessed vulnerability information among those reported by domestic product developers. If using vulnerable software, system administrators should apply security patches or update their system as soon as possible to prevent damage.
| No | ID | Title | CVSS Score | Date Public |
|---|---|---|---|---|
| 1 | JVNDB-2016-002716 | Cross-site Scripting Vulnerability in Hitachi Tuning Manager | 5.0 | 2016/5/18 |
| 2 | JVNDB-2016-001559 | Information Disclosure Vulnerability in Hitachi Compute Systems Manager | 3.5 | 2016/3/4 |
| 3 | JVNDB-2016-002715 | Information Disclosure Vulnerability in Hitachi Command Suite | 5.0 | 2016/5/18 |
| 4 | JVNDB-2016-001472 | Remote File Inclusion Vulnerability in Hitachi Command Suite | 10.0 | 2016/2/24 |
| 5 | JVNDB-2015-006527 | Cross-site Scripting Vulnerability in uCosminexus Portal Framework and Groupmax Collaboration | 3.5 | 2015/12/28 |
Note 1) Color Code for CVSS Base Score and Severity Level
| CVSS Base Score = 0.0～3.9 Severity Level = I (Low) |
CVSS Base Score = 4.0～6.9 Severity Level = II (Medium) |
CVSS Base Score = 7.0～10.0 Severity Level = III (High) |
Note 2) Color Code for Published Date
| Published in 2014 and before | Published in 2015 | Published in 2016 |
(*1) Japan Vulnerability Notes: A portal for vulnerability countermeasure information including information on vendor response to the reported vulnerabilities and security support. Operated in the collaboration of IPA and JPCERT/CC.
https://jvn.jp/en/
(*2) National Vulnerability Database: A vulnerability database operated by NIST.
http://nvd.nist.gov/home.cfm
(*3) National Institute of Standards and Technology: A U.S federal agency that develops and promotes measurement, standards and technology.
http://www.nist.gov/
(*4) Emergency Security Alert for Apache Struts 2
https://www.ipa.go.jp/security/ciadr/vul/20160427-struts.html (Japanese)
(*5) Emergency Security Alert for Apache Struts Remote Code Execution Vulnerability
https://www.ipa.go.jp/security/ciadr/vul/20160620-jvn.html (Japanese)
(*6) How to Secure Your Websites
https://www.ipa.go.jp/security/vuln/websecurity.html (Japanese)
(*7) Hands-on vulnerability learning and exercising tool "AppGoat"
https://www.ipa.go.jp/security/vuln/appgoat/index.html (Japanese)
(*8) IPA Technical Watch - Daily Practice Guide: Tips on Vulnerability Management
The guide gives tips on how to efficiently and efficiently collect and leverage vulnerability information.
https://www.ipa.go.jp/security/technicalwatch/20150331.html (Japanese)
IT Security Center,
Information-technology Promotion Agency, Japan (ISEC/IPA)
