Il SANS Institute (SysAdmin, Audit, Networking, and Security) ha recentemente pubblicato un rapporto in cui vengono elencati e descritti i 25 errori di programmazione più comuni, disponibile anche in formato PDF.
L’istituto si è avvalso della collaborazione di 30 esperti per stilare questo elenco in cui gli errori più pericolosi sono raggruppati in 3 categorie:
- Insecure Interaction Between Components (9 errori);
- Risky Resource Management (9 errori);
- Porous Defenses (7 errori).
Qui di seguito presentiamo i 25 errori, suddivisi nelle 3 categorie: per ciascuno, diamo anche un link per l’approfondimento.
Categoria: Insecure Interaction Between Components
- CWE-20: Improper Input Validation – link ;
- CWE-116: Improper Encoding or Escaping of Output – link;
- CWE-89: Failure to Preserve SQL Query Structure (
aka ‘SQL Injection’) – link; - CWE-79: Failure to Preserve Web Page Structure (aka ‘Cross-site Scripting’) – link;
- CWE-78: Failure to Preserve OS Command Structure (aka ‘OS Command Injection’) – link;
- CWE-319: Cleartext Transmission of Sensitive Information – link;
- CWE-352: Cross-Site Request Forgery (CSRF) – link;
- CWE-362: Race Condition – link;
- CWE-209: Error Message Information Leak – link.
Categoria: Risky Resource Management
- CWE-119: Failure to Constrain Operations within the Bounds of a Memory Buffer – link;
- CWE-642: External Control of Critical State Data – link;
- CWE-73: External Control of File Name or Path – link;
- CWE-426: Untrusted Search Path – link;
- CWE-94: Failure to Control Generation of Code (aka ‘Code Injection’) – link;
- CWE-494: Download of Code Without Integrity Check – link;
- CWE-404: Improper Resource Shutdown or Release – link;
- CWE-665: Improper Initialization – link;
- CWE-682: Incorrect Calculation – link.
Categoria: Porous Defenses
- CWE-285: Improper Access Control (Authorization) – link;
- CWE-327: Use of a Broken or Risky Cryptographic Algorithm – link;
- CWE-259: Hard-Coded Password – link;
- CWE-732: Insecure Permission Assignment for Critical Resource – link;
- CWE-330: Use of Insufficiently Random Values – link;
- CWE-250: Execution with Unnecessary Privileges – link;
- CWE-602: Client-Side Enforcement of Server-Side Security – link.
La “top 25” degli errori verrà regolarmente aggiornata sul sito SANS e su quello del MITRE.
