The World's Oldest Software Vulnerability
- May 10, 2009 11:42 AM EST
- [num] Comments
It would seem that the oldest documented software security vulnerability is a password file disclosure vulnerability in Multics CTSS on the IBM 7094 mainframe system. The date on the report is 1965; It's specifically January 1, 1965 and there's none of the self-promotion of modern vulnerability disclosure in it; perhaps the authors were ashamed of the bug?
CTSS (Compatible Time Sharing System) was an IBM 7094 operating system developed at MIT Multics was Multiplexed Information and Computing Service, The point of all of these products was time-sharing and other multi-user and multi-tasking features. While it was long before the Internet and everyone got cynical, the authors of Multics and CTSS were concerned about security.
The bug happened when multiple instances of the system text editor were opened on the system. They would crash (the exact cause of the crash is not discussed) and create temporary files with specific names, with the bizarre result that anyone logging on to the system would see the CTSS password file. There is no evidence that anyone's bank account was hacked as a result of this.