As Holiday Shopping Season Approaches Online Buyers Beware -- Cenzic Study Estimates Approximately 90 Percent of Web Applications Are Vulnerable

Cenzic Inc., the innovative leader of application vulnerability assessment and risk management solutions, today released their Application Security Trends Report for Q3 , 2007. The report highlights the alarming trend among thousands of corporations and government agencies -- the majority of them have yet to initiate any action in protecting their Web applications, as application vulnerabilities continue to run rampant.

The report is a thorough analysis of reported vulnerabilities, Web application probes, attack statistics and key findings, and emphasizes the top 10 vulnerabilities from published reports in Q3 2007. Based on trends, published data, data from its managed services business unit, and various other sources, Cenzic believes that of the estimated 100 to 150 million Web applications, approximately 90 percent are still likely vulnerable.

"With each quarter, new application vulnerabilities are building up and organizations are falling behind in protecting their Web applications," said Mandeep Khera, VP of marketing for Cenzic. "We continue to be surprised by the inaction or insufficient action of thousands of corporations and government agencies toward securing their Web applications. We are not talking about being 100% secure at the application layer. We are simply talking about initiating some action, making it at least somewhat difficult for the cybercriminals to gain access."

Khera further stated, "The holiday season is around the corner and security should be a major concern for consumers and they should definitely take precautions with online holiday shopping."

What can you do as a consumer? Ask your provider specifically what they are doing about securing the Web applications that sit underneath the Web sites. Not just SSL. Not network firewalls. But, Web applications. How secure are they? What are the processes to secure them? What happens if hackers get the information? If nothing else, this will force the companies to start thinking about it. At the very minimum, make sure you do business with well known and reputable companies. In some cases, you can also tell the quality of these companies by their Web site design and the questions they ask. For more tips on online shopping, visit the Privacy Rights Clearing House's online shopping tips at http://www.privacyrights.org/fs/fs23-shopping.htm .

What can you do as an online provider? Do a thorough test of your Web applications and find the vulnerabilities. There are automated solutions available, both as a software and a Software as a Service (SaaS) that can quickly point to the major security holes. Once you find them, prioritize based on their criticality and help your developers get the right resources to start fixing them as soon as possible. It's never too late to start.

Cenzic Application Security Trend Report - Q3

In the Q3 Trend Report, Cenzic identified 1,471 unique published vulnerabilities in the third quarter of 2007, with cross-site scripting (XSS) and SQL injection as the most frequent vulnerabilities reported. Of the vulnerabilities that were published, 68 percent were related to Web technologies, a slight decrease from Q2 2007 but still forming a significant portion of total vulnerabilities. Once again, 70 percent of these reported vulnerabilities are classified as easily exploitable. Cenzic also evaluated several emerging trends that signal the effects of Web 2.0 programming practices and architectures within the reported vulnerability information. To download the Cenzic Application Security Trends Report Q3 2007, visit http://www.cenzic.com .

Top 10 Vulnerabilities in Commercial and Open Source Web Applications from Q3 2007:

--  Bugzilla Webservice - A remote user can create a user account in
    Bugzilla using the Web service, even if the account creation has been
    disabled by the administrator, allowing for unauthorized users to gain
    access to data by creating the new account.

--  Sun Java System Access Manager - Sun Java System Access Manager 7.1,
    when installed in a Sun Java System Application Server 9.1 container, does
    not demand authentication after a container restart, allowing remote
    attackers to perform administrative tasks.

--  Rational Clearquest - The login page does not properly validate user-
    supplied input in the username field, allowing a remote user the ability to
    supply specially crafted parameter value to execute SQL commands on the
    underlying database which can be exploited to bypass authentication.

--  Tomcat Host Manager - Cross-site scripting (XXS) vulnerability in the
    Host Manager Servlet for versions of Apache Tomcat allows remote attackers
    to inject arbitrary HTML and Web script via crafted requests.

--  Apache mod-proxy - The date handling code in Apache 2.3.0, when using
    a threaded MPM, allows remote origin servers to cause a denial of service.

--  Java Runtime Environment - A vulnerability found in Java Runtime
    Environment 5.0 Update 9 and prior allows a remote user to cause arbitrary
    code to be executed on a target user's system, allowing remote applets to
    gain elevated privileges.

--  Apache Tomcat - Versions of Apache Tomcat do not properly handle the
    backslash and single quote characters sequence in cookie value, which might
    cause sensitive information such as session IDs to be leaked to remote
    attackers and enable session hijacking attacks.

--  Sun Java Systems Web Server - Versions of Sun Java System Web Servers
    have a CRLF injection vulnerability in the redirect feature, allowing
    remote attackers to inject arbitrary HTTP headers and conduct HTTP response
    splitting attacks.

--  IBM WebSphere Application Server - Multiple unspecified
    vulnerabilities in versions of IBM WebSphere Application Server have
    unknown impact and attack vectors.

--  Java Web Start JNLP - A Remote user can create a specially crafted
    JNLP file that, when loaded by the target user, will trigger a stack
    overflow and execute arbitrary code on the target system, which can be
    exploited automatically via a maliciously crafted Web page.