Top 25: cele mai periculoase erori de programare
Scris de Alex Sima
Mai mult de 30 de grupuri de securitate au realizat o lista cu cele mai periculoase greseli de programare, lucru care se inscrie in trendul existent. Cele doua tabere, cea a dezvoltatorilor si cea a atacatorilor, se ciocnesc zilnic, ultimele lupte de amploare avand ca teren de razboi companii ca Google.
Dennis Blair, directorul National Intelligence din S.U.A., a declarat recent ca infrastructura Statelor Unite este sever amenintata de atacuri cibernetice. Multe din aceste atacuri se bazeaza pe vulnerabilitati software.
La randul sau, Alan Paller, Directorul Institutului de cercetare SANS, a spus ca unul dintre scopurile acestei liste este de a ajuta companiile sa evite situatiile jenante, cum a fost cu cei de la Siemens. Acestia au platit peste 100.000 de Euro pe un pachet de programe si au aflat apoi ca securitatea lor nu facea parte din intelegere. Dupa negocieri intense, au platit inca aproximativ 145.000 de Euro pentru securitate.
Iata clasamentul:
Loc | Scor | ID | Nume
[1] 346 CWE-79 Failure to Preserve Web Page Structure (‘Cross-site Scripting’)
[2] 330 CWE-89 Improper Sanitization of Special Elements in an SQL Command (‘SQL Injection’)
[3] 273 CWE-120 Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’)
[4] 261 CWE-352 Cross-Site Request Forgery (CSRF)
[5] 219 CWE-285 Improper Access Control (Authorization)
[6] 202 CWE-807 Reliance on Untrusted Inputs in a Security Decision
[7] 197 CWE-22 Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
[8] 194 CWE-434 Unrestricted Upload of File with Dangerous Type
[9] 188 CWE-78 Sanitization of Special Elements in OS Command (‘OS Command Injection’)
[10] 188 CWE-311 Missing Encryption of Sensitive Data
[11] 176 CWE-798 Use of Hard-coded Credentials
[12] 158 CWE-805 Buffer Access with Incorrect Length Value
[13] 157 CWE-98 Control of Filename for Include/Require Statement (‘PHP File Inclusion’)
[14] 156 CWE-129 Improper Validation of Array Index
[15] 155 CWE-754 Improper Check for Unusual or Exceptional Conditions
[16] 154 CWE-209 Information Exposure Through an Error Message
[17] 154 CWE-190 Integer Overflow or Wraparound
[18] 153 CWE-131 Incorrect Calculation of Buffer Size
[19] 147 CWE-306 Missing Authentication for Critical Function
[20] 146 CWE-494 Download of Code Without Integrity Check
[21] 145 CWE-732 Incorrect Permission Assignment for Critical Resource
[22] 145 CWE-770 Allocation of Resources Without Limits or Throttling
[23] 142 CWE-601 URL Redirection to Untrusted Site (‘Open Redirect’)
[24] 141 CWE-327 Use of a Broken or Risky Cryptographic Algorithm
[25] 138 CWE-362 Race Condition
Pentru detalii legate de aceste erori puteti consulta documentul realizat pe siteul CWE (Common Weakness Enumeration).
Etichete: atacuri, extern, online, SANS, Siemens, software, stiri, topuri
