Software vulnerabilities fell in 2009, but the number of bugs in document readers and multimedia applications surged, says IBM.
According to the company's annual X-Force Trend and Risk Report, 6,601 new vulnerabilities were recorded in 2009, which is 11 percent less than in 2008. But IBM said the number of vulnerability disclosures for document readers, editors and multimedia applications rose by 50 percent.
IBM classifies those as client-side vulnerabilities, which also include vulnerabilities affecting browsers and operating systems.
Of the five most prevalent website exploits, three involved PDF (Portable Document Format) files.
Attackers have had much success in finding vulnerabilities in Adobe's PDF software and conduct attacks through spam campaigns and malicious websites.
"There's definitely a group of bad guys out there that are targeting that piece of software," said Tom Cross, IBM X-Force research manager.
Browsers had the most client-side vulnerabilities, IBM said. Mozilla's Firefox had twice the number of critical to high vulnerabilities as Internet Explorer in 2009, but on the bright side, none of those problems were left unpatched by the end of the year.
While on average most vendors patch 66 percent of those outstanding vulnerabilities, Apple proved the worst, patching just 38 percent.
IBM also looked at overall patching rates. The company said Research In Motion, the GNU community, Cisco Systems, Adobe and HP had "stellar" records. Cisco only had one percent of its critical to high vulnerabilities left without patches by the end of the year, while the rest had none.
Those with the highest percentages of those types of unpatched vulnerabilities were the Linux community at 53 percent, Oracle at 38 percent, Novell at 31 percent and IBM at 27 percent.
Web application vulnerabilities
The X-Force also took a look at web application vulnerabilities, a potentially dangerous condition for websites that could result in data loss and other harm.
The news isn't great: some 67 percent of web application problems did not have a patch by the end of 2009. Cross-site scripting overtook SQL injection as the number-one type of web application vulnerability disclosure, IBM said.
Cross-site scripting is an attack in which a script is allowed to run that shouldn't, which can be used to steal information.
SQL injection occurs when input commands are validated and instead executed by a back-end database, which also can reveal data, among other malicious uses.
The number of SQL injection attacks seen by IBM in 2008 was around 5,000 a day, Cross said.
In 2009, IBM was seeing upwards of a million SQL injection attacks a day as attackers used automated tools to find weak websites, he said.
Many times hackers sought to insert HTML into a web page via SQL injection that causes people to be redirected to another site.
The hackers are "trying to get that malicious link in a legitimate website that has an audience, and that audience will be redirected to the exploit [website]", Cross said.
IBM said it also saw a massive increase in malicious web links in 2009.
While the number of SQL injection vulnerability disclosures fell in 2009, many web applications are custom-built, so they may have many more problems than commonly used web apps.
"The importance of identifying and fixing web application vulnerabilities has never been greater than it is right now," Cross said.