IBM: Vulnerabilities fell in 2009, but other risks abound

IBM's latest X-Force report says there are fewer software bugs overall, but many in document and multimedia applications

The number of software vulnerabilities fell overall in 2009, but the number of bugs in document readers and multimedia applications increased by 50 percent, according to IBM's annual X-Force Trend and Risk Report.

IBM's X-Force research and development team studies vulnerability disclosures and collects other data on Web-based attacks. In 2009, the team recorded 6,601 new vulnerabilities, which is 11 percent less than in 2008.

But IBM said the number of vulnerability disclosures for document readers, editors and multimedia applications rose by 50 percent. IBM classifies those as client-side vulnerabilities, which also include vulnerabilities affecting browsers and operating systems.

Of the five most prevalent Web site exploits, three involved PDF (Portable Document Format) files. Attackers have had much success in finding vulnerabilities in Adobe's PDF software and conduct attacks through spam campaigns and malicious Web sites.

"There's definitely a group of bad guys out there that are targeting that piece of software," said Tom Cross, IBM X-Force research manager.

The other two exploits involved Flash and an ActiveX control that allows people to view a Microsoft Office document in Internet Explorer, IBM said.

Browsers had the most client-side vulnerabilities, IBM said. Mozilla's Firefox had twice the number of critical to high vulnerabilities as Internet Explorer in 2009, but on the bright side, none of those problems were left unpatched by the end of the year.

More than half of the critical to high client-side vulnerabilities affected just four vendors: Microsoft, Adobe, Mozilla and Apple, IBM said. While on average most vendors patch 66 percent of those outstanding vulnerabilities, Apple proved the worst, patching just 38 percent.

IBM also looked at overall patching rates. The X-Force said Research In Motion, the GNU community, Cisco Systems, Adobe Systems and Hewlett-Packard had "stellar" records. Cisco only had 1 percent of its critical to high vulnerabilities left without patches by the end of the year, while the rest had none.

Those with the highest percentages of those types of unpatched vulnerabilities were the Linux community at 53 percent, Oracle at 38 percent, Novell at 31 percent and IBM at 27 percent.

The X-Force also took a look at Web application vulnerabilities, a potentially dangerous condition for Web sites that could result in data loss and other harm.

The news isn't great: Some 67 percent of Web application problems did not have a patch by the end of 2009. Cross-site scripting overtook SQL injection as the number-one type of Web application vulnerability disclosure, IBM said.

Cross-site scripting is an attack in which a script is allowed to run that shouldn't, which can be used to steal information. SQL injection occurs when input commands are validated and instead executed by a back-end database, which also can reveal data, among other malicious uses.

The number of SQL injection attacks seen by IBM in 2008 was around 5,000 a day, Cross said. In 2009, IBM was seeing upwards of a million SQL injection attacks a day as attackers used automated tools to find weak Web sites, he said.

Many times hackers sought to insert HTML into a Web page via SQL injection that causes people to be redirected to another site.

The hackers are "trying to get that malicious link in a legitimate Web site that has an audience, and that audience will be redirected to the exploit" Web site, Cross said. IBM said it also saw a massive increase in malicious Web links in 2009.

While the number of SQL injection vulnerability disclosures fell in 2009, many Web applications are custom-built, so they may have many more problems than commonly used Web apps.

"The importance of identifying and fixing Web application vulnerabilities has never been greater than it is right now," Cross said.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags securityIBMmarket researchexploits and vulnerabilitiesX-Force

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Cool Tech

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Breitling Superocean Heritage Chronographe 44

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?