3

I've been asked to compile a list of the number of published web vulnerabilities or exploits grouped by platform.

With the understanding and caveat that numbers are just statistics, shouldn't be used to predict the future, are totally unfair, worse than lies and damn lies, and probably will kill your cat, etc., etc.: Do these numbers exist anywhere? How can such a list be compiled?

My attempt
I figured the CVE database was a good place to start; you can download their entire database in CSV format and then just grep it. Which seemed reasonable enough, except it appears that there isn't enough data in each row.

For example, of the 59 CVEs this year that mention "Wordpress", there are 14 that don't contain the letters "php". So clearly grepping for "php" won't net the right result. Presumably neither will any of the others.

The data don't have to be perfect, they just have to be reasonably substantiated (i.e. not pulled out of one's derriere), and most importantly the measurement should be neutral (that is, shouldn't obviously favor or penalize any given platform), except to the extent that any one platform is naturally more popular than another.

Recent numbers (last year, this year, whatever) would be best, but whatever exists is even better.

Improve this question
10
  • 4
    You should include cats as a possible target platform. I'll start you off: all of them are vulnerable to a laser-pointer DoS.
    – Polynomial
    Commented Sep 21, 2012 at 8:36
  • 1
    @Polynomial: I never thought about it this way, but I really can't disagree. Tylerl: You have to remember that any such data is negatively skewed to OSS: even trivial vulnerabilities are disclosed, while with proprietary software it's basically critical and nothing else.
    – Hubert Kario
    Commented Sep 21, 2012 at 12:20
  • 2
    Can you define what you mean by "platform"? Do you mean the programming language (Java, ASP.NET, PHP) that the web application is written in? The web programming framework that the web application is written on top of? The web application that is running? Something else?
    – D.W.
    Commented Sep 23, 2012 at 17:57
  • 1
    @AviD: (I don't argue one way or the other now) OK, so let's assume that you're right. Then there is a positive skew to OSS. What I wanted to say, is that because of different development practices, there is a skew in the data based only on number of vulnerabilities. (following is with RMS hat on ;) The only proprietary closed source vendors I deal with are MS and Adobe (Flash only). I don't remember if I ever saw medium or low risk vulnerability fixed by MS Update hotfix... (which would show that the data is non-uniform, on top of being skewed) In conclusion: this data is useless.
    – Hubert Kario
    Commented Sep 23, 2012 at 22:06
  • 1
    @HubertKario I dont disagree that the data is non-uniform, not to mention incomplete and partial. My only point is that it is not skewed in any particular direction, in fact the randomness of the incompleteness is the only uniform aspect. On the other hand, I dont think this data is useless, it has value even without being accurate.
    – AviD ♦
    Commented Sep 24, 2012 at 0:21

4 Answers 4

Reset to default
3

I know of two pieces of research in the research literature that study the incidence of vulnerabilities on different platforms:

  • An Empirical Analysis of Input Validation Mechanisms in Web Applications and Languages. Theodoor Scholte, Davide Balzarotti, William Robertson, Engin Kirda. SAC 2012.

    • This paper analyzes over 7000 CVEs that reported XSS and SQL injection vulnerabilities in 79 web applications. Then, it uses this data to estimate the prevalence of different kinds of input validation vulnerabilities in different web programming languages.

      The paper's analysis finds some differences between languages. For instance, in the data set, 50% of web applications were built in PHP, but 80% of SQL injection vulnerabilities were in PHP applications, so the paper concludes that web applications written in PHP may be especially at risk for SQL injection. In contrast, web applications written in Java appear to be less prone to XSS and SQL injection vulnerabilities. See the paper for more discussion.

  • Exploring the Relationship Between Web Application Development Tools and Security. Matthew Finifter and David Wagner. WebApps 2011.

    • This paper analyzes the relationship between the choice of programming language and web development framework vs security, by looking at code from 9 teams who built the same web application (same spec, same functionality) in different languages.

      The paper does not find any evidence that choice of programming language affects the security of the resulting application. The experiment does find evidence that the degree of support for security (particularly automatic support for escaping, sanitization, session management, etc.) benefits security. It concludes that, because of the small sample size, additional experiments would be helpful to gain a deeper understanding of the effect of programmer tools on web security.

Improve this answer
1
  • Very, very interesting.
    – tylerl
    Commented Sep 24, 2012 at 4:22
1

The national vulnerability database is a good reference for statistical data but I'm not sure if they have a listing per platform but you can check it out. http://web.nvd.nist.gov/view/vuln/statistics

Improve this answer
1

Secunia has in their site some statistical information about vulnerabilities divided by vendor and product. For example to Windows XP Professional:

http://secunia.com/advisories/product/22/?task=statistics

They collect information since 2003. The page is mainly composed by graphics and at this time most of them are being showed.

Improve this answer
1
  • I think the question is asking about vulnerabilities in web applications (I agree the question is not 100% clear, but that's how I'm reading it). That Secunia site doesn't seem to have statistics on web applications.
    – D.W.
    Commented Sep 24, 2012 at 4:28
0

I did something similar for a client a few years ago, and I think your direction of CVE is a decent one.
However, as you saw, it is not completely straightforward, nor will you ever be able to get accurate stats - often, the platform is not mentioned at all.

What you will need to do, is create a list of terms that are common for each platform you're interested in, and then accumulatively grep for all of them. E.g. for PHP you would need php wordpress zend drupal joomla etc.

Yes, you will need to build this up iteratively. No, you shouldnt ever expect to have the complete set of stats, but it can give you some kind of picture.
Anyway, CVEs are not all of the known vulnerabilities in these products, not to mention the fact that home-grown apps or specific sites built on these platforms would not hit CVE either...

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .