Firefox Most Vulnerable Browser, Safari Close 369
An anonymous reader writes "Cenzic released its report revealing the most prominent types of Web application vulnerabilities for the first half of 2009. The report identified over 3,100 total vulnerabilities, which is a 10 percent increase in Web application vulnerabilities compared to the second half of 2008. Among Web browsers, Mozilla Firefox had the largest percentage of Web vulnerabilities, followed by Apple Safari, whose browser showed a vast increase in exploits, due to vulnerabilities reported in the Safari iPhone browser." It seems a bit surprising to me that this study shows that only 15% of vulnerabilities are in IE.
Huh? (Score:5, Interesting)
So just down the page on slashdot, this very day, there are warnings about a "Windows kernel vulnerability" that is exploited through IE. I'll take three cross-site scripting bugs any day over a kernel level compromise, thank you.
I know the world doesn't have a good objective measure of "impact" to assign to these things so that one could assess the total "probable inconvenience" of the presented security vulnerabilities, and that makes unbiased data gathering difficult, but this feels pretty absurd.
Re:I wonder (Score:1, Interesting)
Doesn't matter. If the browser cannot protect itself from its own add-ons then it is still the browser at fault.
Glad I don't use Firefox, Safari or IE.
Re:I wonder (Score:4, Interesting)
So in other words, this isn't a count of how many vulnerabilities there are, it's a count of how many vulnerabilities are found and fixed.
Something tells me their methodology is a bit flawed. Of course, that's by design, given Cenzic's financial ties to Microsoft.
Nothing to see here (Score:3, Interesting)
From the report.
Wait... so vendors and now applications?
They continue to say that Java and PHP are very vulnerable, but it's actually applications written in Java and PHP, not the language+runtime itself. In that case you could say that C++ has the most vulnerabilities.
Re:I wonder (Score:5, Interesting)
Still, do you really have to read it?
It seems like one of these bootlicking/astro-turfing 'studies' from some consulting agency or 'solution' vendor comes along about every 6 months in the Slashdot headlines.
Upon reading TFA, this one seems no more credible than any other.
Re:Firefox IS getting infected in the wild (Score:3, Interesting)
Its plugins. Ive seen several machines recently infected, no files were showing as having been downloaded, but based on the temp files used to start the infection it appears that Adobe Reader is being used quite a lot as an avenue for infection
Re:I wonder (Score:2, Interesting)
Re:I wonder (Score:4, Interesting)
Re:I wonder (Score:2, Interesting)
I have experience here (Score:3, Interesting)
So, I'm posting as somebody who has gotten critical fixes pushed into both IE and Firefox. (Technically, Chrome and Opera too, but those were the pure crypto vulns.)
It's genuinely hard to write a secure web browser. Forget plugins -- you have a complex internal object model, subject to all sorts of very fine grained rules ("the filename on an input type=file form must not be settable from Javascript"), which can be made into a pile of moving parts under the control of an attacker. What's happened somewhat recently is a lot more people have gotten into bashing Firefox. You know those "many eyes" theories of open source, and how they're usually kind of full of it?
Well, "many eyes" are visiting it now, and Mozilla to their credit is doing a lot of very hard work to deal with the influx. Good on them.
Re:I wonder (Score:5, Interesting)
Plus a few under 10%. The funny thing is that the article seems to blame the browser for SQL Injection, Web Server, Information Leak / Disclosure? WTF?
... what?
Information Leaks could be the result of any attack, SQL Injection has nothing at all to do with any browser and "Web Server"? There is no real information other than a nice shaded 3D pie chart so what this guy is trying to prove is beyond me. It also includes Path Traversal which is server side as well, code injection well injection into what? The browser, the server
Even if some agrees that these companies are actual web applications and not software companies, you would have to agree that there really are only about 10 commonly used web servers [netcraft.com] in total so Sun, IBM and Apache will be on this list regardless of the exploit.
Looking at the real report [cenzic.com] all of the exploits blamed on the browsers are based on SQL Injections and propagating malicious code from the originator of the web site so how could one browser handle this more effectively then another? This doesn't really make a lot of sense so anyone gifted with more ability then myself please reply below.
Details? (Score:2, Interesting)
So I *did* RTFA and found it was fluff. So I read the linked PDF report to try and find out some details on what these gaping security holes in my favourite browser actually were. I did not want to have to eat crow over my repeated recommendations to us Firefox over IE because it was more secure. Well, there's plenty of space dedicated to reporting server side vulnerabilities, plenty on web apps, lots of repetition of how surprised they were to find Firefox and Safari so vulnerable...but nothing on what vulnerabilities. No mention of types of vulnerability, frequency, core browser, plug-ins, add-ins, versions, ZIP!
The 29 page report has one page that is mostly taken up with a lovely colourlful exploded pie chart. There is more space dedicated to advertising the Cenzic products and services than there is referencing browser vulnerabilities.
This is isn't a report, it's a sales pitch.
Re:I wonder (Score:4, Interesting)
I was wondering that myself... how is SQL injection a fault of the browser? I mean... I suppose a plugin could try SQL injections when submitting forms, but I don't see how that could be any worse on any other browser, AND it doesn't compromise the browser or the client's system.
SQL injection? (Score:3, Interesting)
The top vulnerability is SQL injection.
Can anybody explain how the browser is responsible for SQL injection vulns?
Re:I wonder (Score:5, Interesting)
Re:I wonder (Score:3, Interesting)
the sum over all vulnerabilities of:
(number of browsers with vulnerability) x (damage possible if vulnerability is exploited) x (chance of actually exploiting the vulnerability).
Being open and honest about bugs is a good thing (Score:3, Interesting)
Haven't RTFA yet but I bet they are using patch notes as their source of vulnerabilities.
So the headline should have been "Firefox most transparent browser when it comes to vulnerabilities".
I'm no FF fanboi. I think they've gone off the rails in a lot of ways - especially by forcing users to accept changes that many changes they don't like such as AWFULBAR. However one thing they do right is they're transparent about bugs and vulnerabilities (at least once they're able to reproduce them). The whole article is a fucking troll.
Re:who is cenzic? (Score:2, Interesting)
367 http://search.cert.org/search?q=advisory+internet+explorer [cert.org]
89 http://search.cert.org/search?q=advisory+netscape [cert.org]
61 http://search.cert.org/search?q=advisory+firefox [cert.org]
20 http://search.cert.org/search?q=advisory+safari [cert.org]
18 http://search.cert.org/search?q=advisory+opera [cert.org]
12 http://search.cert.org/search?q=advisory+lynx [cert.org]
clearly, the fewer number of letters in the name of your browser makes it more secure.
Re:I wonder (Score:3, Interesting)
Possibility that if the majority of the document is on server level stuff, then did they maybe test IE with "enhanced protection" that comes with server? Effectively its like firefox with no-script but has none of the user-friendliness of no-script.
Re:I wonder (Score:3, Interesting)
Firefox is much more tuned to individual users, and needs extra plugins like NoScript to give rudimentary access level controls.
But Firefox supports the latest and greatest web standards, has a real community of users which make great plugins like NoScript and Adblock and Firebug, and is always trying new things like the awesome bar. If I wanted tin-foil-hat level security I'd use IE8 with a restrictive security policy, but realistically these days the difference between highly secure and pretty-damned-secure isn't that great; you're more likely to get a virus by being a dumbass and installing something you shouldn't than from an actual web-browser vulnerability.
I do think trying to find flaws in the study and questioning the motives when it doesn't look favorably on your favorite browser, as most people here are doing, is just narrow minded and petty.
Re:I wonder (Score:3, Interesting)
From what I understand the report was based on the number of vulnerabilities patched, not announced
The pdf of the report is linked from the article. Browser vulnerabilities are mentioned on only one page, on which no methodology is discussed. Most of the article has to do with web applications. For the web applications, they repeatedly use the term "reported vulnerabilities", not patched. They do discuss that the number of actual vulnerabilities may be lower than reported vulnerabilities for proprietary web applications. I'd bet they're using reported vulnerabilities for browsers too. Here is the entire text of the section on Web Browser Vulnerabilities:
So this report is entirely useless. They don't discuss their methodology, which is likely to be suspect. Ignore it.