October 08, 2004

SANS releases updated Top 20 Vulnerabilities List

SANS has updated their list of top 20 vulnerabilities on the Internet. You might find some of their findings interesting:

Top Vulnerabilities to Windows Systems:

  1. Web Servers & Services
  2. Workstation Service
  3. Windows Remote Access Services
  4. Microsoft SQL Server (MSSQL)
  5. Windows Authentication
  6. Web Browsers
  7. File-Sharing Applications
  8. LSAS Exposures
  9. Mail Client
  10. Instant Messaging

Top Vulnerabilities to UNIX Systems:
  1. BIND Domain Name System
  2. Web Server
  3. Authentication
  4. Version Control Systems
  5. Mail Transport Service
  6. Simple Network Management Protocol (SNMP)
  7. Open Secure Sockets Layer (SSL)
  8. Misconfiguration of Enterprise Services NIS/NFS
  9. Databases
  10. Kernel

Compare that to a year ago.

Top Vulnerabilities to Windows Systems in 2003:

  1. Internet Information Services (IIS)
  2. Microsoft SQL Server (MSSQL)
  3. Windows Authentication
  4. Internet Explorer (IE)
  5. Windows Remote Access Services
  6. Microsoft Data Access Components (MDAC)
  7. Windows Scripting Host (WSH)
  8. Microsoft Outlook and Outlook Express
  9. Windows Peer to Peer File Sharing (P2P)
  10. Simple Network Management Protocol (SNMP)

Top Vulnerabilities to UNIX Systems in 2003:
  1. BIND Domain Name System
  2. Remote Procedure Calls (RPC)
  3. Apache Web Server
  4. General UNIX Authentication Accounts with No Passwords or Weak Passwords
  5. Clear Text Services
  6. Sendmail
  7. Simple Network Management Protocol (SNMP)
  8. Secure Shell (SSH)
  9. Misconfiguration of Enterprise Services NIS/NFS
  10. Open Secure Sockets Layer (SSL)

Interesting findings. On the surface much has changed. But not really. Look closely. Network attack vectors via a web server is still a paramount concern on Windows. And BIND continues to be the achilles heel on Unix. What does that really tell us though? It is always easier to breach something exposed to the masses remotely and anonymously. Is this because of secure software engineering failure, configuration failure or a failure in education. (Or a piece of each).

What I DID find insteresting was that this year, "web servers" have been clumped together. IIS always used to stand out because of the various weaknesses in it; IIS6 was a totally new design through the SD3+C methodology and its showing to be successful. Now its just en mass with Apache, and iPlanet/SunOne. Will be interesting to see a snapshot next year... I am going to guess the SD3+C push will have mitigated a lot of this as more businesses move to W2K3.

Posted by SilverStr at October 8, 2004 10:12 AM | TrackBack