Security - Channel Insider
Empowering the next generation Channel

Web Application Vulnerabilities Skyrocket
By Ericka Chickowski on 2010-03-16



If application security isn't already top of mind among your customers, it probably should be. As a channel partner, you owe it to your customers to raise their awareness of how shoddy in-house application development and a complicit trust of all web applications on the Internet could cost them in damaging breaches and compliance woes with regulations such as PCI DSS. Released this month, the Cenzic Application Security Trends Report Q3-Q4 2009 showed how much the application vulnerability problem is growing within the corporate landscape over the second half of last year.
  • of
Unprotected Web

• Web vulnerabilities made up 82 percent of the 2,652 commercial vulnerabilities found and analyzed by Cenzic.

• Of those Web vulnerabilities, 89 percent were related to code in commercial Web applications.

• Among commercial Web application vulnerabilities, cross-site scripting (XSS) bugs made up 19 percent and SQL injection made up 16 percent

Browser Holes

Web browser vulnerabilities made up another 8 percent and Web server vulnerabilities an additional 3 percent.

Number of Browser Vulnerabilities Found

• Mozilla Firefox: 77

• Internet Explorer: 44

• Safari: 25

• Google Chrome: 25

Widespread Problem

Of all of the applications analyzed by Cenzic's Click2Secure managed service, 93 percent suffered from some sort of information leak or exposure that could give hackers clues for further attack

• 81 percent suffered from XSS vulnerabilities

• 72 percent suffered from session management problems

• 71 percent had authentication and authorization issues

WebSphere Woes

Of Web server vulnerabilities, WebSphere bugs made up 51 percent of the issues

Adobe Most Hacked

According to Cenzic, the vendors with some of the most severe vulnerabilities found in the second half of 2009 included Adobe, Sun and HP. The report gave Adobe the ignominious title of the2009 vendor “The Year’s Most Hacked Software,” due to dangerous problems with Flash, ColdFusion and Reader.

  • More slideshows

  
CHANNEL RESOURCE CENTER
 
 
 

Intel Technology Provider Program
Intel Technology Provider Program (ITP) helps resellers better understand Intel products which power the technology they sell, and enables value-add services such as remote manageability or anti-theft tracking.
Learn More
 
WindowsForDevices.com
WindowsForDevices.com is the comprehensive news site covering Windows embedded technologies. Visitors get news, technical white papers, opinion columns and extensive directories covering the products and companies in the marketplace.
Click Here
 
Check out our top five picks for technologies that will change the game in enterprise computing.
Learn MoreClick Here