[ISN] The IT security vuln league table of fear

[InfoSec News]

http://www.theregister.co.uk/2004/10/11/sans_top_20/

By John Leyden
11th October 2004

A list of the worst 20 security vulnerabilities bedevilling Windows 
and *Nix systems was unveiled last Friday by the SANS (SysAdmin, 
Audit, Network, Security) Institute.

The list, now in its fifth year, is designed to help admins to 
prioritise their efforts so that they can close the most dangerous 
security holes first. It highlights the top 10 Windows and top 10 Unix 
issues in their relative order of importance. The roll of infamy is 
decided by a panel of IT security industry reps, academics, users 
organisations and the SANS Institute.

Top Vulnerabilities to Windows Systems

1.  Web servers & services 
2.  Workstation service 
3.  Windows remote access services 
4.  Microsoft SQL Server 
5.  Windows authentication 
6.  Web browsers 
7.  File-sharing applications 
8.  Window's Local Security Authority Subsystem Service risks 
9.  Mail client 
10. Instant messaging 

Top Vulnerabilities in Unix and Linux Systems

1.  BIND Domain Name System 
2.  Web server 
3.  Authentication 
4.  Version control systems 
5.  Mail transport service 
6.  Simple Network Management Protocol (SNMP) 
7.  Open Secure Sockets Layer (SSL) 
8.  Misconfiguration of Enterprise Services NIS/NFS 
9.  Databases 
10.  Kernel 

As with previous years the list is fairly general and will generate
few surprises among security pros. Despite this the vulnerabilities it
recounts are frequently ignored. These ommissions are a key factor in
the spread of destructive worms. SANS line is that simple precautions,
prompted by raised awareness, can save far greater problems further
down the line.

In a statement SANS said: "The vast majority of worms and other
successful cyber attacks are made possible by vulnerabilities in a
small number of common operating system services. Attackers are
opportunistic. They take the easiest and most convenient route and
exploit the best-known flaws with the most effective and widely
available attack tools. They count on organizations not fixing the
problems, and they often attack indiscriminately, scanning the
Internet for any vulnerable systems. The easy and destructive spread
of worms, such as Blaster, Slammer, and Code Red, can be traced
directly to exploitation of unpatched vulnerabilities."

"Although there are thousands of security incidents each year
affecting these operating systems, the overwhelming majority of
successful attacks target one or more of these twenty vulnerable
services," it added.