4 ms·

Because the vast amount of C code running the internet. That's all. Rewrite everything in <language> and you'd see just as many security vulnerabilities.

lmm 10y ago
I very much doubt that. Buffer overflows simply wouldn't happen in most languages, and those are the majority of the vulnerabilities we see.
- f2f 10y ago
  XSS (cross-site scripting) replaced buffer overflows as the most common vulnerability in 2005. source: http://maxedv.com/wp-content/uploads/2011/12/Sourcefire-25-Years-of-Vulnerabilities-Research-Report.pdf http://maxedv.com/wp-content/uploads/2011/12/Sourcefire-25-Y...
- peterwwillis 10y ago
  That appears not to be the case. pwillis@windows:~/Downloads$ wget -q -O allitems.csv https://cve.mitre.org/data/downloads/allitems.csv pwillis@windows:~/Downloads$ ( for year in `seq 1999 2016` ; do TOTAL=`cat allitems.csv | grep -v RESERVED | grep "^CVE-$year" | wc -l`; BUFF=`cat allitems.csv | grep -v RESERVED | grep "^CVE-$year" | grep -i -e "buffer.*overflow\|overflow.*buffer" | wc -l`; PERCENT=`awk "BEGIN{print $BUFF/$TOTAL*100}" | cut -d. -f1`; echo "Year $year: $TOTAL CVEs, $BUFF buffer overflow related, $PERCENT% total" ; done ) Year 1999: 1573 CVEs, 307 buffer overflow related, 19% total Year 2000: 1237 CVEs, 250 buffer overflow related, 20% total Year 2001: 1540 CVEs, 278 buffer overflow related, 18% total Year 2002: 2370 CVEs, 481 buffer overflow related, 20% total Year 2003: 1519 CVEs, 346 buffer overflow related, 22% total Year 2004: 2670 CVEs, 470 buffer overflow related, 17% total Year 2005: 4686 CVEs, 519 buffer overflow related, 11% total Year 2006: 7047 CVEs, 612 buffer overflow related, 8% total Year 2007: 6510 CVEs, 868 buffer overflow related, 13% total Year 2008: 7034 CVEs, 619 buffer overflow related, 8% total Year 2009: 4888 CVEs, 589 buffer overflow related, 12% total Year 2010: 4954 CVEs, 419 buffer overflow related, 8% total Year 2011: 4441 CVEs, 428 buffer overflow related, 9% total Year 2012: 5219 CVEs, 399 buffer overflow related, 7% total Year 2013: 5731 CVEs, 382 buffer overflow related, 6% total Year 2014: 7494 CVEs, 326 buffer overflow related, 4% total Year 2015: 6526 CVEs, 357 buffer overflow related, 5% total Year 2016: 7180 CVEs, 471 buffer overflow related, 6% total According to this really shitty review of CVEs, buffer overflow is less than 10% (recently less than 6%) of tracked vulnerabilities. That's still a lot, of course.
  - lmm 10y ago
    Fair enough; I was thinking of the occasional "the whole internet is broken" CVEs we see a few times a year. My impression is that they're mostly C and mostly memory-safety, but that's a human subjective thing. The right thing would be to weight by severity and number of users impacted, and bundle all the memory-safety vulnerabilities together (i.e. buffer overflow, double free, use-after-free, aliasing violation). I'll add it to the big list of blog posts I want to write.

lmm 10y ago

I very much doubt that. Buffer overflows simply wouldn't happen in most languages, and those are the majority of the vulnerabilities we see.

f2f 10y ago
XSS (cross-site scripting) replaced buffer overflows as the most common vulnerability in 2005. source: http://maxedv.com/wp-content/uploads/2011/12/Sourcefire-25-Years-of-Vulnerabilities-Research-Report.pdf http://maxedv.com/wp-content/uploads/2011/12/Sourcefire-25-Y...
peterwwillis 10y ago
That appears not to be the case. pwillis@windows:~/Downloads$ wget -q -O allitems.csv https://cve.mitre.org/data/downloads/allitems.csv pwillis@windows:~/Downloads$ ( for year in `seq 1999 2016` ; do TOTAL=`cat allitems.csv | grep -v RESERVED | grep "^CVE-$year" | wc -l`; BUFF=`cat allitems.csv | grep -v RESERVED | grep "^CVE-$year" | grep -i -e "buffer.*overflow\|overflow.*buffer" | wc -l`; PERCENT=`awk "BEGIN{print $BUFF/$TOTAL*100}" | cut -d. -f1`; echo "Year $year: $TOTAL CVEs, $BUFF buffer overflow related, $PERCENT% total" ; done ) Year 1999: 1573 CVEs, 307 buffer overflow related, 19% total Year 2000: 1237 CVEs, 250 buffer overflow related, 20% total Year 2001: 1540 CVEs, 278 buffer overflow related, 18% total Year 2002: 2370 CVEs, 481 buffer overflow related, 20% total Year 2003: 1519 CVEs, 346 buffer overflow related, 22% total Year 2004: 2670 CVEs, 470 buffer overflow related, 17% total Year 2005: 4686 CVEs, 519 buffer overflow related, 11% total Year 2006: 7047 CVEs, 612 buffer overflow related, 8% total Year 2007: 6510 CVEs, 868 buffer overflow related, 13% total Year 2008: 7034 CVEs, 619 buffer overflow related, 8% total Year 2009: 4888 CVEs, 589 buffer overflow related, 12% total Year 2010: 4954 CVEs, 419 buffer overflow related, 8% total Year 2011: 4441 CVEs, 428 buffer overflow related, 9% total Year 2012: 5219 CVEs, 399 buffer overflow related, 7% total Year 2013: 5731 CVEs, 382 buffer overflow related, 6% total Year 2014: 7494 CVEs, 326 buffer overflow related, 4% total Year 2015: 6526 CVEs, 357 buffer overflow related, 5% total Year 2016: 7180 CVEs, 471 buffer overflow related, 6% total According to this really shitty review of CVEs, buffer overflow is less than 10% (recently less than 6%) of tracked vulnerabilities. That's still a lot, of course.
- lmm 10y ago
  Fair enough; I was thinking of the occasional "the whole internet is broken" CVEs we see a few times a year. My impression is that they're mostly C and mostly memory-safety, but that's a human subjective thing. The right thing would be to weight by severity and number of users impacted, and bundle all the memory-safety vulnerabilities together (i.e. buffer overflow, double free, use-after-free, aliasing violation). I'll add it to the big list of blog posts I want to write.