The Continuing Threat of Unpatched Security Vulnerabilities

Unpatched software is a computer code containing known security
weaknesses. Unpatched vulnerabilities refer to weaknesses that
allow attackers to leverage a known security bug that has not been
patched by running malicious code. Software vendors write additions
to the codes, known as “patches,” when they come to know about
these application vulnerabilities to secure these weaknesses.

Adversaries often probe into your software, looking for
unpatched systems and attacking them directly or indirectly. It is
risky to run unpatched software. This is because attackers get the
time to become aware of the software’s unpatched
vulnerabilities^[1]
before a patch emerges.

A report^[2]
found that unpatched vulnerabilities are the most consistent and
primary ransomware attack vectors. It was recorded that in 2021,
65 new vulnerabilities
arose that were connected to ransomware. This was observed to be a
twenty-nine percent growth compared to the number of
vulnerabilities in 2020.

Groups involved in ransomware are no longer just focused on
single unpatched instances. They have started looking at groups of
multiple vulnerabilities, third-party applications prone to
vulnerabilities, protocols concerning technology, etc. It is to be
noted that these groups have gone to the extent of launching
attacks by recruiting insiders.

Warnings^[3]
concerning the cyber security threats of unpatched vulnerabilities
to critical infrastructure entities have been issued by various
governmental institutions such as the FBI, the National Security
Agency, the Cybersecurity and Infrastructure Security Agency, and
the Homeland Security Department.

This blog discusses a few examples of vulnerabilities and how
updating applications can help prevent cyberattacks.

The Top 3 Most Severe Vulnerabilities in 2021

The National Institute of Standards and Technology (NIST)
reported finding 18,378^[4]
vulnerabilities in 2021. According to HackerOne, software
vulnerabilities increased by 20%^[5]
in 2021 compared to 2020.

The Common Weakness Enumeration, a community-developed list of
software and hardware weakness types, recorded the top 25 most
dangerous software weaknesses (CWE Top 25). This list consists of
the most common and impactful issues experienced over the previous
two calendar years. The top three most severe vulnerabilities
recorded in 2021 are:

1. Out-of-bounds Write: In this type^[6]
   of vulnerability, the software writes data past the intended
   buffer’s end or before its beginning. This results in data
   corruption, crash, or code execution. In simple terms, it causes
   memory corruption. It is a result of writing to invalid memory or
   that which is beyond the buffer’s bounds. The sequential copy of
   excessive data originating from a location is only one of the many
   other causes.

1. Cross-site Scripting: This is also known as
   ‘Improper Neutralization of Input During Web Page Generation.’
   Here, user-controlled input is not neutralized or is improperly
   neutralized before it is placed in output that is then used as a
   web page served to other users.

These software vulnerabilities^[7] enable attackers to
introduce client-side scripts into web pages viewed by other users.
It is used to bypass access controls like the same-origin
policy.

1. Out-of-bounds Read: The software reads data
   past the end or before the beginning of the intended buffer in
   this kind of application
   vulnerability^[8]. Hackers can access
   sensitive information through unauthorized memory leaks and can
   crash the system. Crashes occur when an external code piece
   attempts to read variable amounts of data. When it comes across a
   sentinel, the reading operation is stopped during the process,
   resulting in a buffer overflow or segmentation fault.

Why is Updating Applications Important?

Software vulnerabilities can be prevented by testing your
software using application vulnerability assessment
tools^[9], white
box testing, black-box testing, and other techniques and updating
it regularly. You can define a set of principles to be followed in
developing each software release to prevent vulnerabilities. Sign
your code digitally using a code signing certificate to maintain a
tamper-proof code. This will help ensure digital safety and avoid
security issues.

An ideal and effective patch management process should include
an audit system to identify patches and vulnerable systems, deploy
updates, and automate the patch management process.

Software updates can include repairing security holes adding new
features and/or software patches. Outdated ones can be removed from
your device, and new features can be introduced to upgrade the
application security and prevent unpatched vulnerabilities.

Security holes are covered, and your data is protected from
hackers. This helps prevent attackers’ access to personal
information and documents, which might be misused to commit crimes.
Data is encrypted in case of ransomware attacks. Remediating
vulnerabilities in the applications can also cut the chances of
hackers accessing the data of people you contact.

A hacking incident can ruin the image of your enterprise. This
is one of the most important reasons why you should have an
effective vulnerability and patch management process in hand and
keep updating your applications regularly.

Conclusion

A report by Redscan Labs showed that 90% of all common
vulnerabilities and exposures (CVEs) uncovered in 2021 could be
exploited by attackers without any technical skills. The report
classifies 54% of vulnerabilities as having “high” availability.
This means that they are readily and easily accessible or
exploitable by hackers.

This makes it important to understand what CVEs are and what
needs to be done to prevent them. The first step to this is to
analyze and regularly update your applications with security
monitoring tools like Indusface WAS.^[10] Secondly, an effective
way to tamper-proof your website is to use a code signing
certificate.

Unpatched vulnerabilities are hazardous to your digital safety
and data security. Thus, it is incumbent upon software vendors to
understand and follow procedures to ensure patching of website and
application vulnerabilities.