IBM: Software bugs fall, but hackers target PDF, Flash, ActiveX

The number of software vulnerabilities fell overall in 2009, but the number of bugs in document readers and multimedia applications increased by 50 percent, according to IBM's annual X-Force Trend and Risk Report.

IBM's X-Force research and development team studies vulnerability disclosures and collects other data on web-based attacks. In 2009, the team recorded 6,601 new vulnerabilities, which is 11 percent less than in 2008.

But IBM said the number of vulnerability disclosures for document readers, editors and multimedia applications rose by 50 percent. IBM classifies those as client-side vulnerabilities, which also include vulnerabilities affecting browsers and operating systems.

Of the five most prevalent Web site exploits, three involved PDF (Portable Document Format) files. Attackers have had much success in finding vulnerabilities in Adobe's PDF software and conduct attacks through spam campaigns and malicious Web sites.

"There's definitely a group of bad guys out there that are targeting that piece of software," said Tom Cross, IBM X-Force research manager.

The other two exploits involved Flash and an ActiveX control that allows people to view a Microsoft Office document in Internet Explorer, IBM said.

Browsers had the most client-side vulnerabilities, IBM said. Mozilla's Firefox had twice the number of critical to high vulnerabilities as Internet Explorer in 2009, but on the bright side, none of those problems were left unpatched by the end of the year.

More than half of the critical to high client-side vulnerabilities affected just four vendors: Microsoft, Adobe, Mozilla and Apple, IBM said. While on average most vendors patch 66 percent of those outstanding vulnerabilities, Apple proved the worst, patching just 38 percent.

IBM also looked at overall patching rates. The X-Force said Research In Motion, the GNU community, Cisco Systems, Adobe Systems and Hewlett-Packard had "stellar" records. Cisco only had 1 percent of its critical to high vulnerabilities left without patches by the end of the year, while the rest had none.

Those with the highest percentages of those types of unpatched vulnerabilities were the Linux community at 53 percent, Oracle at 38 percent, Novell at 31 percent and IBM at 27 percent.

The X-Force also took a look at web application vulnerabilities, a potentially dangerous condition for Web sites that could result in data loss and other harm.

The news isn't great: Some 67 percent of web application problems did not have a patch by the end of 2009. Cross-site scripting overtook SQL injection as the number-one type of web application vulnerability disclosure, IBM said.

Cross-site scripting is an attack in which a script is allowed to run that shouldn't, which can be used to steal information. SQL injection occurs when input commands are validated and instead executed by a back-end database, which also can reveal data, among other malicious uses.

The number of SQL injection attacks seen by IBM in 2008 was around 5,000 a day, Cross said. In 2009, IBM was seeing upwards of a million SQL injection attacks a day as attackers used automated tools to find weak Web sites, he said.

Many times hackers sought to insert HTML into a Web page via SQL injection that causes people to be redirected to another site.

The hackers are "trying to get that malicious link in a legitimate website that has an audience, and that audience will be redirected to the exploit" website, Cross said. IBM said it also saw a massive increase in malicious web links in 2009.

While the number of SQL injection vulnerability disclosures fell in 2009, many web applications are custom-built, so they may have many more problems than commonly used Web apps.

"The importance of identifying and fixing web application vulnerabilities has never been greater than it is right now," Cross said.