Web Application Security Newsletter - August 2006

A MESSAGE FROM THE EDITOR - This month's issue casts a wide net in informing our readers of the latest threats and vulnerabilities and presenting many practical tips on staying ahead of the curve in the serious business of web application security. From Ajax to PHP vulnerabilities to the lesser known but potentially devastating CRLF injection attack, it has never been more crucial to stay informed and proactive in the quest to secure your web applications. Anyone with a website these days can fall victim to a malicious attack. You'll read about an Internet gumshoe and 130 hacked websites whose owners were victims of schemes such as an iframe vulnerability attack. Also read about Cenzic's Top Five, the most critical Web application vulnerabilities named for May and June 2006.

1. Application Security News: New chapter and verse on Ajax security

Ajax popularity raises security concerns
Ajax poses the same security risk as any web application as well as some additional unique security challenges. Andrew van der Stock has written a chapter on Ajax security issues for an updated version of Guide to Building Secure Web Applications. In this interview, he shares his thoughts about risks that developers should be concerned about in the Ajax development environment. He shares design tips around a lean-client, service-oriented architecture and emphasizes the untrustworthy nature of the client. A three-tier model for Ajax web application development is presented.

Read More

2. Helping Ajax developers stay ahead of the bad guys

Preventing attacks and bolstering security for Ajax apps
In Part Two of an interview with Andrew van der Stock, he discusses ways to prevent attacks against Ajax applications, such as server-side access control, and presents specific tips on strengthening security. He warns about the dangers of client-side authorization as a recipe for disaster and points out the characteristics of strong validation. By implementing the basics of data validation, good architecture, and safer API, developers can be ahead of the security curve in protecting Ajax applications from attack.

Read More

3. CRLF injection attacks: How they work and what to do about them

A lesser known application attack can prove devastating
Although lesser known, a carriage return/line feed (CRLF) injection can be just as effective and devastating. Understanding how these attacks occur can help you defend against them. A CRLF attack allows a crafty attacker to create havoc in a number of ways, such as providing input to a vulnerable application that ends up deleting all files on the root partition. Lessons learned include being on the cautionary side by viewing all data from unknown sources as tainted.

Read More

4. Net Watchdog: Hacked Sites Cause Headaches

Protect your Web site from the latest hack attack schemes
Anyone with a Web site runs the risk of an intruder hacking the site as a way to distribute malicious adware, spyware, rootkits, and more. Internet gumshoe Harry Sverdlove, a Senior Research Scientist, can cite 130 such sites that have fallen prey to an identical form of malicious attack. One scheme has to do with the insertion of an "iframe vulnerability" in the site's HTML code, which happens unbeknownst to the site owner. At any time, hackers can then maliciously use their victim's site to pump out malware. Read about these latest schemes used to infect Web sites and about measures you can take to protect your site.

Read More

5. PHP Top 5 Attacks

Five major attack vectors are threats to PHP applications
Although a popular language, PHP has many flawed security features. This article presents research findings based on the SANS Top 20 2005's PHP section. It includes a review of Bugtraq postings containing "PHP" and categorizes each unique flaw. One key finding is that Safe Mode is anything but safe. In fact, Safe Mode is vulnerable to all five major attack vectors. The research offers detailed analysis of the top five threats, how to determine your level of vulnerability, and how to protect against attack.

Read More

6. Cenzic Research Lab Names Top Five Critical Web Application Vulnerabilities for May and June

Top 5 pose the most serious risk
Cenzic's Intelligent Analysis Research Lab (CIA) team analyzed all web application vulnerabilities discovered in May and June 2006 and named the top five most serious threats. Vulnerabilities in HP Openview, Weblogic Server, PHP Hypertext Processor, Postgres, Sun ONE, and Sun Java System Application Server were named as presenting the most serious risk for potential attacks. The CIA's research is used as a starting point in addressing the security needs of customer and commercial web applications in enterprise environments. Findings are released on a monthly or bi-monthly basis.

Read More