5 Important Software Vulnerabilities

A software vulnerability is a glitch, flaw, or weakness present in the software or in an OS (Operating System). The severity of software vulnerabilities advances at an exponential rate. Of course, all systems include vulnerabilities. The thing is whether or not they’re exploited to cause damage.

Software vulnerabilities are explained by three ideal factors. These are:

• Existence – The existence of a vulnerability in the software.

• Access – The possibility that hackers gain access to the vulnerability.

• Exploit – The capability of the hacker to take advantage of that vulnerability via tools or with certain techniques.

More and more organizations today are seeing vulnerabilities in their code exploited. For instance, here we presented the table that shows the top 10 software products with the most security flaws in 2016 with the reference of CVSS system:

Table 1: Top 10 Products With Distinct Vulnerabilities in 2016

5 Important Software Vulnerabilities and Attacks

In order to build secure software, it is indispensable to have an understanding of software vulnerabilities. Here, we presented a brief overview of important, and dangerous, vulnerabilities.

SQL Injection

SQL injection vulnerabilities leave the chance to inject malicious code into a SQL statement(s). With this vulnerability, hackers can provide database applications with some malicious data, and the application utilizes that data to construct a SQL statement by using string concatenation. Then the attackers get the chance to change the SQL query semantics.

Table 2: Ranking in the CWE List

Affected Languages

Any coding language that can be used inline with a SQL database is prone to this vulnerability. However, here are some common languages:

• High-level language: Perl, Ruby, Python, Java, VB.Net, SQL
• Server Page technologies: ASP, JSP, ASP.NET, PHP
• Lower level Languages: C, C++

OS Command Injection

OS Command Injection vulnerabilities happen when software integrates user-manageable data in a command, which is handled under the shell command interpreter. If the data is unchecked, a hacker can make use of shell metacharacters to change the command that is being executed. This weakness is language independent.

Table 3: Ranking in the CWE List

Buffer Overflow

The buffer overflow vulnerability is a well-known sort of security vulnerability. It occurs when a program tries to add more data in the buffer than its storage capacity allows. Writing outside of a block of owed memory can crash the program, corrupt data, and even cause the execution of malicious code. Languages like Java, Python, Visual Basic, and C# include bound check arrays and native string types. Hence, buffer overflow is considered to be impossible in environments written in these languages.

Table 4: Ranking in the CWE List

Table 5: The Following Table Shows the Relevant Entries of This Vulnerability in the CWE List:

Affected Languages

• Language: C, Fortran, Assemblys
• Environments: Application Servers, web servers, and web applications.

Uncontrolled Format String

This vulnerability involves accepting unchecked or unauthorized user input as a format string to execute a function. This weakness can lead to the execution of harmful code and even can crash the system.

Table 6: Ranking in the CWE List

Affected Languages

• Directly vulnerable: C, C++
• Indirectly vulnerable: Perl (if read in a sort of tampered data).

Integer Overflow

The integer overflow vulnerability exists when the calculation attempts to increment an integer value which is higher than the integer used to store it in the relevant representation. When this error happens, the integer value may convert to become a negative or very small number. This weakness becomes security critical when the calculation result is used to handle the control looping, determine the size or offset in behaviors (like copying, memory allocation, concatenation, etc.), and make a decision.

Table 7: Ranking in the CWE List

Table 8: The Following Table Shows the Relevant Entries of This Vulnerability in the CWE List:

Affected Languages

Mostly all languages are affected; however, the resulting effects differ based on how it handles the integers.

• Dangerous languages: C, C++