SANS/FBI Release Top 20 Security Vulnerabilities

theBraindonor writes "SANS Institute and the FBI have compiled a listing of the The Twenty Most Critical Internet Security Vulnerabilities. The list is broken down into two groups: Windows Systems and Unix Systems." The list of Unix vulnerabilities is also a list of the network programs I (and presumably many others) use most. It's a good thing there's BugTraq.

Comments

#8 = Internet Explorer.

[garcia]

#8 is listed here.

If you are using IE, your computer is vunerable to numerous security breaches.

If this is installed on EVERY Windows computer by default, I believe that this should be rated higher than those vunerabilities in applications that are only installed by default on SOME Windows versions (IIS).

Re:Well, that settles that argument

[sunset]

To restate your point more bluntly:

Saying that "The Twenty Most Critical Internet Security Vulnerabilities" is the same as the top ten Windows vulnerabilities plus the top ten Unix vulnerabilities, is just plain stupid.

Re:Not again

[airrage]

WSH is an important tool, but it's only the command interpreter, it's the code that's sent to it and how it executes that truly the problem.

But the most overlooked part of Windows 2000 and above is Microsoft's implementation of the Windows Management Instrumentation (WMI) API. With this interface an admin can script against any Microsoft Class and has full rights to change, modify, stop, start, etc. The box is yours. And it's installed by default!

Currently, it's a little under the radar, so many are unaware of it's implementation, but remote scripting is completely available and documented, just need the first exploit to overcome the security context and Houston we have a problem.

Their SNMP experts aren't experts...

[hardaker]

Here's a note I just sent to their web master (they had no other place to send "comments"):

Overall the top20 list is a good summary as always.

However, I can't believe the lack of knowledge about at least the SNMP portion of it. SNMP *used to use* clear-text community strings in the first and second versions of the protocols. The following statement, along with others in the section:

'SNMP uses an unencrypted "community string" as its only authentication mechanism. Lack of encryption is bad enough...'

Is spreading simply incomplete information. At a minimum, it should be suggested that all users upgrade their SNMP enabled software to version 3 compliant SNMP agents and to disable the version 1 and version 2 SNMP protocols. All of the major network vendors, as well as software vendors implement the v3 protocol so there is very little excuse for not using it (and, worst case you can deploy v3->v1 proxies near v1-devices to minimize the transmision distance of clear-text v1 community strings). *Please* change the wording to suggest that people upgrade their equipment to SNMPv3 compliant software, which will take care of at least the insecure problems with the protocol.