DHS, Mitre Name SQL Injection Flaws As Most Dangerous Software Error

Vulnerabilities that leave applications open to SQL injection are the most dangerous software errors in cyberspace, according to rankings issued earlier this week by top security groups.

Issued by the Department of Homeland Security, Mitre, and the SANS Institute, the "2011 CWE/SANS Top 25 Most Dangerous Software Errors" is a list of the most widespread and critical errors that can lead to serious vulnerabilities in software.

"They are often easy to find, and easy to exploit," the groups say. "They are dangerous because they will frequently allow attackers to completely take over the software, steal data, or prevent the software from working at all."

The Top 25 list is an extension of a list that has been issued in the past by Mitre and the SANS Institute to help programmers to prevent the kinds of vulnerabilities that often lead to application breaches -- data on more than 800 programming errors, design errors, and architecture errors that can lead to exploitable vulnerabilities. The list was selected from more than 800 errors recorded in Mitre's Common Weakness Enumeration (CWE) database.

This year's Top 25 entries are prioritized using inputs from more than 20 different organizations, which evaluated each weakness based on prevalence, importance, and likelihood of exploit. It uses the Common Weakness Scoring System (CWSS) to score and rank the final results.

Operating-system command injection finished second on the "most dangerous" list, followed by buffer overflow and cross-site scripting.

One purpose of the list is to give weight to specific flaws, in hopes of driving programmers to avoid them, says Alan Paller, director of the SANS Institute. "It helps to show that some errors have a high value and some have low value," Paller says. "You can't give a programmer a list of 860 things that need to be fixed and expect them to respond. They'll throw the list away. You need to give them some weight."

Application security experts say the list helps raise consciousness on specific types of errors, but they wonder how much impact it will likely have on software developers.

"Everyone seems to be focusing on the fact that SQL injection made it to No. 1 this year, but I find myself thinking, 'So what?'" says Vinnie Liu, a founder of the consulting firm Stach & Liu, which offers application assessment and testing services. "SQL injection was the vulnerability behind the Sony, Infraguard, and other recent attacks. Yet no matter if it’s No. 1, No. 4, or No. 10, it always has been one of the primary causes of significant data breaches in the past, and it will continue to be for many years to come." Have a comment on this story? Please click "Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.