The FBI has teamed up with the SANS Institute to draw up a list of the worst 20 security vulnerabilities bedevilling Windows and *Nix systems.

The list, now on its third year, serves as a general resource most specifically aimed at less experienced admins. It highlights the top 10 Windows and top 10 Unix issues in their relative order of importance.

Top Vulnerabilities to Windows Systems

1. 
   
2. Internet Information Services (IIS)
   
3. Microsoft Data Access Components (MDAC) - Remote Data Services
   
4. Microsoft SQL Server
   
5. NETBIOS - unprotected Windows Networking Shares
   
6. Anonymous Logon - Null Sessions
   
7. LAN Manager Authentication - weak LM hashing
   
8. General Windows Authentication - accounts with no passwords or weak passwords
   
9. Internet Explorer
   
10. Remote Registry Access
    
11. Windows Scripting Host
    

Top Vulnerabilities to Unix Systems

1. 
   
2. Remote Procedure Calls (RPC)
   
3. Apache Web Server
   
4. Secure Shell (SSH)
   
5. Simple Network Management Protocol (SNMP)
   
6. File Transfer Protocol (FTP)
   
7. R-Services - trust relationships
   
8. Line Printer Daemon (LPD)
   
9. Sendmail
   
10. BIND/DNS
    
11. General Unix Authentication - accounts with no passwords or weak passwords
    
    

    As with previous years the list is fairly generic but then again most security problems originate from well- established problems. Keeping on top of the listed flaws can only help the cause of security on the Net. After all, crackers tend to exploit the path of least resistance.

    So there you have it. The list goes into far more detail on the types of flaws that arise on particular systems, their diagnosis and suggested remedial actions. You can read it in full here. ®

    Related Stories

    FBI lists 20 most dangerous Internet security holes