Cross-site scripting the top security risk

[InfoSec News <alerts () infosecnews org>]

http://www.networkworld.com/news/2006/091806-cross-site-scripting-the-top-security.html

By Matthew Broersma
TechWorld
09/18/06

Web administrators beware: cross-site scripting vulnerabilities are
now far more attractive targets than more notorious bugs such as
buffer overflows, according to new figures from Mitre, a U.S.  
government-funded research organization.

Buffer overflows have long been one of the most common types of bugs
attacked by malware, with Intel and Advanced Micro Devices (AMD) even
building in hardware support for an anti-buffer overflow technology
called NX (No Execute) or XD (Execution Disable).

But a shift is under way, according to Mitre's findings. While buffer
overflows affect executable files written in languages such as C, the
increasing popularity of cross-site scripting (XSS) bugs indicates
attackers are looking more at programming languages typically used for
Web applications, such as Java, .Net and PHP.

Client-side scripting languages generally include same-origin
policies, which allow interaction between Web objects and pages only
as long as they come from the same domain and over the same protocol.  
XSS bugs allow malicious Web sites to find ways around these policies,
potentially accessing sensitive data in other objects or browser
windows.

The second most popular type of attack was SQL injection, which allows
attackers to execute malicious SQL statements within a database. Third
most popluar were PHP "include" vulnerabilities, which can allow
attackers to execute arbitrary script on a server by including them in
an existing script.

Out of about 20,000 reported vulnerabilities recorded by Mitre so far
this year, 21.5% were XSS, 14% were SQL injection and 9.5% were PHP
includes. Buffer overflows came in fourth, at 7.9%.

Mitre first discussed the findings on Wednesday at the Cyber Security
Executive Conference in New York, according to a report from industry
journal Dark Reading.


_________________________________
HITBSecConf2006 - Malaysia 
The largest network security event in Asia 
32 internationally renowned speakers 
7 tracks of hands-on technical training sessions. 
Register now: http://conference.hitb.org/hitbsecconf2006kl/