In computer security, the term vulnerability is a weakness which allows an attacker to reduce a system's Information Assurance. Vulnerability is the intersection of three elements: a system susceptibility or flaw, attacker access to the flaw, and attacker capability to exploit the flaw^[1] . To be vulnerable, an attacker must have at least one applicable tool or technique that can connect to a system weakness. In this frame, vulnerability is also known as the attack surface.

A security risk may be classified as a vulnerability. A vulnerability with one or more known instances of working and fully-implemented attacks is classified as an exploit. The window of vulnerability is the time from when the security hole was introduced or manifested in deployed software, to when access was removed, a security fix was available/deployed, or the attacker was disabled.

Constructs in programming languages that are difficult to use properly can be a large source of vulnerabilities.

Contents 1 Causes 2 Vulnerability disclosure 3 Vulnerability disclosure date 4 Identifying and removing vulnerabilities 5 Examples of vulnerabilities 6 See also 7 References 8 External links

[edit] Causes

• Complexity: Large, complex systems increase the probability of flaws and unintended access points
• Familiarity: Using common, well-known code, software, operating systems, and/or hardware increases the probability an attacker has or can find the knowledge and tools to exploit the flaw
• Connectivity: More physical connections, privileges, ports, protocols, and services and time each of those are accessible increase vulnerability
• Password management flaws: The computer user uses weak passwords that could be discovered by brute force. The computer user stores the password on the computer where a program can access it. Users re-use passwords between many programs and websites.
• Fundamental operating system design flaws: The operating system designer chooses to enforce sub optimal policies on user/program management. For example operating systems with policies such as default permit grant every program and every user full access to the entire computer. This operating system flaw allows viruses and malware to execute commands on behalf of the administrator. [1]
• Internet Website Browsing: Some internet websites may contain harmful Spyware or Adware that can be installed automatically on the computer systems. After visiting those websites, the computer systems become infected and personal information will be collected and passed on to third party individuals.
• Software bugs: The programmer leaves an exploitable bug in a software program. The software bug may allow an attacker to misuse an application.
• Unchecked user input: The program assumes that all user input is safe. Programs that do not check user input can allow unintended direct execution of commands or SQL statements (known as Buffer overflows, SQL injection or other non-validated inputs).

[edit] Vulnerability disclosure

This article is written like a personal reflection or essay and may require cleanup. Please help improve it by rewriting it in an encyclopedic style. (June 2008)

This section does not cite any references or sources. Please help improve this article by adding citations to reliable sources. Unsourced material may be challenged and removed. (June 2008)

The method of disclosing vulnerabilities is a topic of debate in the computer security community. Some advocate immediate full disclosure of information about vulnerabilities once they are discovered. Others argue for limiting disclosure to the users placed at greatest risk, and only releasing full details after a delay, if ever. Such delays may allow those notified to fix the problem by developing and applying patches, but may also increase the risk to those not privy to full details. This debate has a long history in security; see full disclosure and security through obscurity. More recently a new form of commercial vulnerability disclosure has taken shape, as some commercial security companies offer money for exclusive disclosures of zero day vulnerabilities. Those offers provide a legitimate market for the purchase and sale of vulnerability information from the security community.

From the security perspective, a free and public disclosure is only successful if the affected parties get the relevant information prior to potential hackers, if they did not the hackers could take immediate advantage of the revealed exploit. With Security Through Obscurity the same rule applies, but this time rests on the hackers finding the vulnerability themselves, as opposed to being given the information from another source. The disadvantage here is that there is a lower number of people with full knowledge of the vulnerability who can aid in finding similar or related scenarios.

It should be unbiased to enable a fair dissemination of security critical information. Most often a channel is considered trusted when it is a widely accepted source of security information in the industry (e.g. CERT, SecurityFocus, and Secunia). Analysis and risk rating ensure the quality of the disclosed information. The analysis must include enough details to allow a concerned user of the software to assess his individual risk or take immediate action to protect his or her assets.

[edit] Vulnerability disclosure date

The time of disclosure of a vulnerability is defined differently in the security community and industry. It is most commonly referred to as "a kind of public disclosure of security information by a certain party". Usually, vulnerability information is discussed on a mailing list or published on a security web site and results in a security advisory afterward.

The time of disclosure is the first date a security vulnerability is described on a channel where the disclosed information on the vulnerability has to fulfill the following requirement:

• The information is freely available to the public
• The vulnerability information is published by a trusted and independent channel/source
• The vulnerability has undergone analysis by experts such that risk rating information is included upon disclosure

[edit] Identifying and removing vulnerabilities

Many software tools exist that can aid in the discovery (and sometimes removal) of vulnerabilities in a computer system. Though these tools can provide an auditor with a good overview of possible vulnerabilities present, they can not replace human judgment. Relying solely on scanners will yield false positives and a limited-scope view of the problems present in the system.

Vulnerabilities have been found in every major operating system including Windows, Mac OS, various forms of Unix and Linux, OpenVMS, and others. The only way to reduce the chance of a vulnerability being used against a system is through constant vigilance, including careful system maintenance (e.g. applying software patches), best practices in deployment (e.g. the use of firewalls and access controls) and auditing (both during development and throughout the deployment lifecycle).

[edit] Examples of vulnerabilities

Vulnerabilities may result from weak passwords, software bugs, a computer virus or other malware, a script code injection, a SQL injection or misconfiguration. Three examples: an attacker finds and uses an overflow weakness to install malware to export sensitive data; an attacker convinces a user to open a email message with attached malware; an insider copies a hardened, encrypted program onto a thumb drive and cracks it at home.

In the system context, computer users can also be considered flaws, see Social engineering (security).

Common types of software flaws that lead to vulnerabilities include:

• Memory safety violations, such as:
  • Buffer overflows
  • Dangling pointers
• Input validation errors, such as:
  • Format string bugs
  • Improperly handling shell metacharacters so they are interpreted
  • SQL injection
  • Code injection
  • E-mail injection
  • Directory traversal
  • Cross-site scripting in web applications
  • HTTP header injection
  • HTTP response splitting
• Race conditions, such as:
  • Time-of-check-to-time-of-use bugs
  • Symlink races
• Privilege-confusion bugs, such as:
  • Cross-site request forgery in web applications
  • Clickjacking
  • FTP bounce attack
• Privilege escalation
• User interface failures, such as:
  • Warning fatigue [2] or user conditioning [3]
  • Blaming the Victim Prompting a user to make a security decision without giving the user enough information to answer it [4]
  • Race Conditions [5]

[edit] See also

• Exploit (computer security)
• Computer security
• Computer insecurity
• Common Vulnerabilities and Exposures (CVE)
• Common Vulnerability Scoring System (CVSS)
• Y2K

[edit] References

[edit] External links

This article's external links may not follow Wikipedia's content policies or guidelines. Please improve this article by removing excessive or inappropriate external links. (June 2009)

• Security advisories links from the Open Directory http://www.dmoz.org/Computers/Security/Advisories_and_Patches/
• Languages Standard's group: Guidance for Avoiding Vulnerabilities through Language Selection and Use
• Microsoft Security Response Center: Definition of a Security Vulnerability
• List of fixes that are included in Windows XP Service Pack 3
• NIST Software Assurance Metrics and Tool Evaluation (SAMATE) project
• Open Source Vulnerability Database (OSVDB) homepage
• Open Web Application Security Project
• Common Vulnerabilities and Exposures (CVE)
• IBM Internet Security Systems (ISS) X-Force research and development team
• ITWIRE: Apple tops vulnerability list, but Microsoft still ahead on exploits August 11, 2008