MITRE.org Publishes the 2009 CWE/SANS Top 25 Most Dangerous Programming Errors

This post is to acknowledge the good work that the MITRE.org team of contributors have done to publish the 2009 list of common programming weaknesses. If you are not familiar with this list, below is a short summary from the version 1.0 document published on 1-12-2009 that is available at http://cwe.mitre.org/top25/index.html

The Top 25 is organized into three high-level categories: Insecure Interaction Between Components, Risky Resource Management, and Porous Defenses. Kudos to the CWE project coordinators Bob Martin from MITRE, and Mason Brown & Alan Paller from the SANS (SysAdmin, Audit, Network, Security) Institute, as well as the group of contributors.

CWE is a Software Assurance strategic initiative sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security.

Insecure Interaction Between Components
These weaknesses are related to insecure ways in which data is sent and received between separate components, modules, programs, processes, threads, or systems.

CWE-20: Improper Input Validation
CWE-116: Improper Encoding or Escaping of Output
CWE-89: Failure to Preserve SQL Query Structure (aka 'SQL Injection')
CWE-79: Failure to Preserve Web Page Structure (aka 'Cross-site Scripting')
CWE-78: Failure to Preserve OS Command Structure (aka 'OS Command Injection')
CWE-319: Cleartext Transmission of Sensitive Information
CWE-352: Cross-Site Request Forgery (CSRF)
CWE-362: Race Condition
CWE-209: Error Message Information Leak

Risky Resource Management
The weaknesses in this category are related to ways in which software does not properly manage the creation, usage, transfer, or destruction of important system resources.

CWE-119: Failure to Constrain Operations within the Bounds of a Memory Buffer
CWE-642: External Control of Critical State Data
CWE-73: External Control of File Name or Path
CWE-426: Untrusted Search Path
CWE-94: Failure to Control Generation of Code (aka 'Code Injection')
CWE-494: Download of Code Without Integrity Check
CWE-404: Improper Resource Shutdown or Release
CWE-665: Improper Initialization
CWE-682: Incorrect Calculation

Porous Defenses
The weaknesses in this category are related to defensive techniques that are often misused, abused, or just plain ignored.

CWE-285: Improper Access Control (Authorization)
CWE-327: Use of a Broken or Risky Cryptographic Algorithm
CWE-259: Hard-Coded Password
CWE-732: Insecure Permission Assignment for Critical Resource
CWE-330: Use of Insufficiently Random Values
CWE-250: Execution with Unnecessary Privileges
CWE-602: Client-Side Enforcement of Server-Side Security

Note: There are a total of 755 weaknesses listed in the full view of the CWE dictionary at http://cwe.mitre.org/data/slices/2000.html