Top 25 Most Dangerous Programming Errors – 2009

گزارشی از پرخطرترین خطاهای برنامه‌نويسي را مطالعه كردم. فوق‌العاده بود. براي معماران نرم‌افزار، طراحان، برنامه‌نويسان، خريداران و صد البته هكرها! منبع و مرجع بسيار غني‌اي است. علاوه بر رتبه‌بندي و ارائه توضيحات كامل در مورد هر خطا، روشهاي پيشگيري و كاهش اثرات نامطلوب آن نيز در حوزه‌هاي مختلفي مانند طراحي و معماري، پياده‌سازي، نيازمندي‌ها، آزمون و عملياتي كردن نيز ذكر شده است.

مي‌توانيد اصل گزارش را در اينجا پيدا كنيد.

(January 12, 2009) Today in Washington, DC, experts from more than 30 US and international cyber security organizations jointly released the consensus list of the 25 most dangerous programming errors that lead to security bugs and that enable cyber espionage and cyber crime.

The Top 25 Errors are listed below in three categories:
Category: Insecure Interaction Between Components (9 errors)
Category: Risky Resource Management (9 errors)
Category: Porous Defenses (7 errors)

CATEGORY: Insecure Interaction Between Components
CWE-20: Improper Input Validation
CWE-116: Improper Encoding or Escaping of Output
CWE-89: Failure to Preserve SQL Query Structure (aka ‘SQL Injection’)
CWE-79: Failure to Preserve Web Page Structure (aka ‘Cross-site Scripting’)
CWE-78: Failure to Preserve OS Command Structure (aka ‘OS Command Injection’)
CWE-319: Cleartext Transmission of Sensitive Information
CWE-352: Cross-Site Request Forgery (CSRF)
CWE-362: Race Condition
CWE-209: Error Message Information Leak
CATEGORY: Risky Resource Management
CWE-119: Failure to Constrain Operations within the Bounds of a Memory Buffer
CWE-642: External Control of Critical State Data
CWE-73: External Control of File Name or Path
CWE-426: Untrusted Search Path
CWE-94: Failure to Control Generation of Code (aka ‘Code Injection’)
CWE-494: Download of Code Without Integrity Check
CWE-404: Improper Resource Shutdown or Release
CWE-665: Improper Initialization
CWE-682: Incorrect Calculation
CATEGORY: Porous Defenses
CWE-285: Improper Access Control (Authorization)
CWE-327: Use of a Broken or Risky Cryptographic Algorithm
CWE-259: Hard-Coded Password
CWE-732: Insecure Permission Assignment for Critical Resource
CWE-330: Use of Insufficiently Random Values
CWE-250: Execution with Unnecessary Privileges
CWE-602: Client-Side Enforcement of Server-Side Security

Organization of the Top 25
CWE ID and name
Supporting data fields
Discussion
Prevention and Mitigations
Related CWEs
Related Attack Patterns
Attack Frequency
Ease of Detection
Remediation Cost
Attacker Awareness

پس‌نوشت: خانم زهرا، اهم مطالب سايت مرجع را به فارسي ترجمه نموده‌اند. مي‌توانيد مطالب را در اينجا مطالعه نماييد. از خانم زهرا بابت تقبل اين زحمت، سپاسگزارم.

Quote:
We are satisfied by doing real work. Software is like a plant that grows: You can’t predict its exact shape, or how big it will grow;you can control its growth only to a limited degree. There are no rules for this kind of thing—it’s never been done before.
– Charlie Anderson, Architect, Borland Quattro Pro for Windows.