The SANS Institute, a cooperative of computer security experts, believe that most hackers use a small number of weaknesses to probe, enter and damage computers and systems. A report released Thursday details the 10 security weaknesses experts believe are most commonly used. Common Gateway Interface programs and application extensions installed on Web servers provide interactivity between Web pages, such as data collection and verification.
Many Web servers come with sample CGI programs installed by default.
Unfortunately, many CGI programmers fail to consider ways in which their programs may be misused or subverted to execute malicious commands. Remote Procedure Call weaknesses allow immediate root compromises. RPCs allow programs on one computer to execute programs on a second computer. They are widely used to access network services such as shared files. The flaws in IIS' RDS are being employed by malicious users to run remote commands with administrator privileges.