Forgot your password?
typodupeerror
Mozilla Security The Internet IT Technology

Firefox Most Vulnerable Browser, Safari Close 369

Posted by CmdrTaco
from the say-what-now dept.
An anonymous reader writes "Cenzic released its report revealing the most prominent types of Web application vulnerabilities for the first half of 2009. The report identified over 3,100 total vulnerabilities, which is a 10 percent increase in Web application vulnerabilities compared to the second half of 2008. Among Web browsers, Mozilla Firefox had the largest percentage of Web vulnerabilities, followed by Apple Safari, whose browser showed a vast increase in exploits, due to vulnerabilities reported in the Safari iPhone browser." It seems a bit surprising to me that this study shows that only 15% of vulnerabilities are in IE.
This discussion has been archived. No new comments can be posted.

Firefox Most Vulnerable Browser, Safari Close

Comments Filter:
  • I wonder (Score:5, Insightful)

    by somersault (912633) on Wednesday November 11, 2009 @01:47PM (#30062652) Homepage Journal

    How many of these vulnerabilities were due to Firefox itself, and how many due to plugins?

    • Re:I wonder (Score:4, Insightful)

      by Shatrat (855151) on Wednesday November 11, 2009 @01:49PM (#30062680)
      Haven't RTFA yet but I bet they are using patch notes as their source of vulnerabilities.
      If that's the case then obviously well-documented and frequently-patched browsers will be over-represented.
      • Re:I wonder (Score:4, Interesting)

        by dkleinsc (563838) on Wednesday November 11, 2009 @01:55PM (#30062772) Homepage

        So in other words, this isn't a count of how many vulnerabilities there are, it's a count of how many vulnerabilities are found and fixed.

        Something tells me their methodology is a bit flawed. Of course, that's by design, given Cenzic's financial ties to Microsoft.

        • Re: (Score:3, Insightful)

          "Haven't RTFA..." -Shatrat
          I guess that's enough for dkleinsc (and most anti-MS slashdotters (slightly redundant, yes)) to jump to conclusions.
          • Re: (Score:2, Informative)

            by cream wobbly (1102689)

            I like your hypocrisy.

            The report (if you'd care to read it) is nothing but FUD leading nicely into a sales pitch.

            • Re: (Score:3, Insightful)

              by Mister Whirly (964219)
              How is that hypocrisy? Unless you think he jumped to a conclusion about the previous poster jumping to a conclusion (which would be a stretch considering the previous poster admitted to have not read the article). He didn't claim they were wrong, only that they were making assumptions because they hadn't read TFA.
        • Re:I wonder (Score:5, Informative)

          by calidoscope (312571) on Wednesday November 11, 2009 @02:25PM (#30063240)
          The Register's article on the Cenzic report also speculated the the report was based on published vulnerabilities. They made some rude noises about Cenzic's focus on the number of the vulnerabilities as opposed to the severity of vulnerabilities.
          • Re:I wonder (Score:5, Insightful)

            by commodore64_love (1445365) on Wednesday November 11, 2009 @05:00PM (#30065556) Journal

            The thing noticed is that the "most vulnerable" browsers were open-source (Firefox, Safari) and the least vulnerable were closed-source (Explorer, Opera) with a huge gap in between these two types.

            Could it be that closed-source aps simply don't publish their vulnerabilities, so that makes them look better?

            • Re:I wonder (Score:5, Insightful)

              by Bigjeff5 (1143585) on Wednesday November 11, 2009 @05:35PM (#30065934)

              Safari is not open-source, WebKit is. Prove me wrong by finding a copy of Safari 4's source code. Yeah, didn't think so. The vulnerabilities aren't necessarily related to the browser engine (though they certainly can be).

              From what I understand the report was based on the number of vulnerabilities patched, not announced. for IE these are released every tuesday of every month, for FireFox I believe they are released whenever they are finished.

              Vulnerabilities patched is a decent indicator, because for closed source you would not know about any unpatched vulnerabilities that were discovered internally (and there are a lot) before patching. Any serious vulnerability that MS knows about MUST be patched for IE, for if it is discovered they knew for any extended period about a serious vulnerability and did nothing, they risk losing the confidence of their business partners.

              So despite the fact that some people, particularly open-source advocates, don't trust MS to patch vulnerabilities, it is certainly in their best interest to do so. The evidence is the speed and number of vulnerabilities they patch.

              I don't think severity would help the metric in favor of Firefox or Safari because serious vulnerabilities get patched as quickly as possible on all sides (except maybe when Safari devs don't consider a severe vulnerability severe, heh), and a large portion of patches that MS releases for IE are less than critical.

              With the most recent versions of IE Microsoft has really cleaned up its act in regards to security, and they have the ability to be the best at it if they choose to be.

              Patched vulnerabilities may not be the best metric, but I think you'd be hard pressed to find a better one.

              • Re:I wonder (Score:5, Insightful)

                by tbannist (230135) on Wednesday November 11, 2009 @06:03PM (#30066364)

                Most of your analysis just seems completely wrong. Microsoft has left vulnerabilities unpatched for years after they were to disclosed before, I see no reason they wouldn't do it again. In theory their business partners might lose confidence, but let's be frank most of Microsoft's business partners are entirely reliant on Microsoft, it'd takes years for them to make any significant changes. Effectively Microsoft can do whatever it wants, and it has.

                Vulnerabilities listed in patch notes are not a good metric for determine which browser is "most vulnerable" because patch notes can be easily gamed by a closed source company. Simply roll up a bunch of nominally related bugs into one patch and suddenly your browser is more secure than the competition. It relies on the all of the groups involved acting in good faith which is naive at best.

                Yesterday Microsoft released a patch for IE that prevents a drive-by rooting of your computer on all versions of Windows (Except 7 and 2008 R2) and all versions of IE. Sure. And yet it's somehow supposedly to be more secure than Firefox?

                We've heard the same tired refrain from Microsoft sponsored people every time they target a new company. They pay people to make up statistics and lie about the competition. I, for one, am tired of it.

                • Re: (Score:3, Insightful)

                  by timmarhy (659436)
                  your tirade should be pointed at apple as well then. they are closed source AND had a shitload of vulnerabilities, as well as having a record of not rolling out patches quickly. whats your excuse for them?

                  maybe you should take a good hard look at OSS supposed security prowess, if you really were so confident firefox is more secure then IE, you wouldn't get so defensive.

              • Re: (Score:3, Interesting)

                by Hatta (162192)

                From what I understand the report was based on the number of vulnerabilities patched, not announced

                The pdf of the report is linked from the article. Browser vulnerabilities are mentioned on only one page, on which no methodology is discussed. Most of the article has to do with web applications. For the web applications, they repeatedly use the term "reported vulnerabilities", not patched. They do discuss that the number of actual vulnerabilities may be lower than reported vulnerabilities for proprietary

        • Re:I wonder (Score:4, Informative)

          by Actually, I do RTFA (1058596) on Wednesday November 11, 2009 @02:35PM (#30063374)

          So in other words, this isn't a count of how many vulnerabilities there are, it's a count of how many vulnerabilities are found and fixed. Something tells me their methodology is a bit flawed. Of course, that's by design, given Cenzic's financial ties to Microsoft.

          Actually, in other words, the GP was making shit up. But since it conformed to your worldview, you agreed with it and based an entire post on it even though he said he didn't RTFA. Somehow it then got modded to +5.

          In reality, the vulnerabilities were culled from a variety of 1st and 3rd party sources.

        • Re:I wonder (Score:5, Informative)

          by Bloody Peasant (12708) on Wednesday November 11, 2009 @03:14PM (#30064114) Homepage

          So in other words, this isn't a count of how many vulnerabilities there are, it's a count of how many vulnerabilities are found and fixed.

          I read the report. It is a marketing document, with one person (Mandeep Khera, Chief Marketing Officer) identified in it as both project lead and executive editor.

          Also, despite the fact that the report itself downplays browser vulnerabilities (8% vs. 90% web apps, 2% web servers), they still put in a single token page which just seems out of place. Nowhere does it say what their methodology is for determining what comprises a "vulnerability". Another poster already pointed out the google search results on the CERT site (~367 for IE, ~61 for Firefox; that's over 6 times more vulnerability reports on the CERT site for IE versus those for Firefox; oops, was I shouting?).

          I suspect the authors' methodology is simply to count something like the number of patches. Given Microsoft's monthly bundling of their security patches, and the Mozilla Firefox project's immediate release of more frequent version updates in response to vulnerability reports and discoveries, such methodology leads to a systematic undersampling of those for IE. A better approach would be to count verified CVE candidates.

          Pure speculation: were they paid by anyone to put that browser breakdown in (it really doesn't seem to belong in my opinion), or was it ignorance or lack of thinking? Without an honest clarification from the company we'll probably never know.

        • Re:I wonder (Score:5, Interesting)

          by http (589131) on Wednesday November 11, 2009 @03:26PM (#30064296) Homepage Journal
          Pardon my ignorance, but how exactly is Cenzic tied financially to Microsoft again? Google's got nothing (and bing has less).
          • Re:I wonder (Score:5, Informative)

            by GumphMaster (772693) on Wednesday November 11, 2009 @05:16PM (#30065738)

            In what way is a Microsoft Certified Partner [cenzic.com] not financially tied to the maintenance of the Microsoft ecosystem in the face of encroaching offerings, particularly in the browser space?

            A more cynical person might assert that a company peddling security assessment tools for web servers would actively promote less secure server systems that kept them in business. Spreading FUD about a browser is only peripheral to that but it does feed the "non-Microsoft is bad" or "open-source is bad" ethic of senior management and bean counters... keeping major systems on Microsoft platforms and Cenzic in business. As I say though, you'd have to cynical ;)

          • Re: (Score:3, Funny)

            by RenderSeven (938535)
            If Bing has less info on Cenzic, it *proves* they are secretly allied with Microsoft!
          • Re: (Score:3, Interesting)

            by kestasjk (933987) *
            I'm a firefox user and I accept this study and that IE8 may well be more secure. They have made huge leaps in security since IE6, using sandboxing and whatnot to lessen the impacts of vulnerabilities found as well, and their security zone settings allow fine-grained choices regarding how secure you want to be vs what you need to run, and the integration with Active Directory allows security policy to be spread across enterprises easily.
            Firefox is much more tuned to individual users, and needs extra plugins
        • Re: (Score:3, Informative)

          by fluffy99 (870997)

          If a vulnerability isn't found, that what's the problem? By that notion, both browsers have undiscovered issues. I do wonder if they were double or triple counting Firefox vulnerabilities as it is supported on more platforms.

          Another, probably more reliable source would be secunia.com. Counting Firefox 3.0.x and 3.5.x, there were a total 18 issues in 2009 (13 and 5 respectively). Counting IE6, IE7, and IE8 there is a total of 18 vulnerabilities (6,6, and 4 respectively). Looks like pretty comparable num

      • The article has a pie chart and the link to the "detailed report" only has a pie chart. I guess we just have to trust Cenzic the internet security application provider. Doesn't even break it down by version number of browser or severity of exploit.
      • Re:I wonder (Score:5, Insightful)

        by PNutts (199112) on Wednesday November 11, 2009 @01:59PM (#30062828)

        I haven't read your post yet but you're wrong.

        • Re:I wonder (Score:5, Interesting)

          by Shatrat (855151) on Wednesday November 11, 2009 @02:05PM (#30062898)
          lol, touche.
          Still, do you really have to read it?
          It seems like one of these bootlicking/astro-turfing 'studies' from some consulting agency or 'solution' vendor comes along about every 6 months in the Slashdot headlines.
          Upon reading TFA, this one seems no more credible than any other.
          • Re: (Score:3, Insightful)

            by tuxgeek (872962)

            bootlicking/astro-turfing 'studies' from some consulting agency or 'solution' vendor comes along about every 6 months

            TFA gives NO details on the OS platform. I would assume FF on M$ would be more exploitable than FF on *nix, given the nature and track record of M$
            Even more ridiculous is the slam of Apache as the top 10% most vulnerable. That is pure bullshit!

        • Re:I wonder (Score:5, Funny)

          by w0mprat (1317953) on Wednesday November 11, 2009 @03:29PM (#30064330)
          I don't even bother posting I use a form.

          -- Slashdot posting form --
          ...
          [ ] RTFA
          [ ] In soviet russia ____ YOU!
          [ ] Obligatory XKCD
          [ ] _____ you insensitive clod.
          [ ] Get off my lawn
          [x] I don't even bother posting I use a form.
          ...

      • Re:I wonder (Score:5, Insightful)

        by MozeeToby (1163751) on Wednesday November 11, 2009 @02:00PM (#30062844)

        Even if their information is accurate, which I don't see how it could possibly be, it is meaningless. Number of flaws is a horrible way to measure system security since it doesn't take into account severity, ease of attack, unreported flaws, or un-acknowledged flaws. When you get down to it, there really isn't any good way to measure security, but I would bet hours spent in code reviews would correlate much better than number of reported flaws.

      • Re:I wonder (Score:5, Insightful)

        by Teflonatron (202441) on Wednesday November 11, 2009 @02:03PM (#30062882)

        I didn't see anything in the actual report that explained how their results were arrived at. For that reason alone, this report is worthless. It's just a marketing document for use in selling their own security products.

        However, it did make reference to the numbers being representative of "reported vulnerabilities", which we all know is going to make Firefox look worse that IE. This is verified by realizing Opera (also closed source) scored less than IE.

      • Re:I wonder (Score:5, Insightful)

        by Sandbags (964742) on Wednesday November 11, 2009 @02:04PM (#30062888) Journal

        Worse, patch SEVERITY was not accounted for in these results, nor was the fact that many patches were for unexploited vulnerabilitys, and others were to close ITW threats...

        FF and Safari rank bad in this article, but when looking at the raw data, patch severity, and explited patch footprint, IE is the worst, even though not patched very often.

        I'd also note that a single patch may include fixes for numerous bugs, and this is additionally not covered in the scope of this article. A single patch in IE recently fixed more than 10 vulnerabilties...

      • You won't find it in TFA. While they gloss over vulnerabilities in Web applications, they're suspiciously tight-lipped about that particular metric, not even mentioning data sources. What's interesting about the facts they do wax lyrical about are typically from the public domain. In other words, it is highly likely that your assumption is bang on the money.

      • Re:I wonder (Score:4, Interesting)

        by noidentity (188756) on Wednesday November 11, 2009 @02:23PM (#30063214)
        Wow, so if I merely released my own binary-only build of Firefox and never mentioned any fixed vulnerabilities in release notes, this study would have found it with far fewer vulnerabilities than Firefox? I think I found a vulnerability in this study...
      • Re:I wonder (Score:5, Informative)

        by natehoy (1608657) on Wednesday November 11, 2009 @02:40PM (#30063478) Journal

        Have read the article, and the attached PDF, and they only state the conclusions. No mention is made of how they counted vulnerabilities, only that Firefox had 44% of them, and that they represented "Web Vulnerabilities by Major Type". Adding to the confusion was that they also talked about applications and servers and alternated back and forth between the three with little warning.

        Also interesting was that "ActiveX" was listed as a technology separate from Web Browsers, the one time it was mentioned. In other words, their vulnerability percentage, which is already vague, may not include ActiveX vulnerabilities within IE. Or they may. All we know is that they claim IE has 15%.

        Nowhere is there mention of what constitutes a reportable vulnerability, what versions of each browser were counted, how they were classified or even what the classifications were, what sorts of reports were included by browser (did plugins or addons get included in Firefox? ActiveX for IE? For multiplatform browsers like Opera, Firefox, and Safari, were vulnerabilities mitigated by only being exploitable on some platforms and not others, or reported multiple times - once for each vulnerable platform?)

        The PDF was severely [citation needed], but remarkably honest in that it expressed surprise that Firefox was the most vulnerable web browser when compared IE, Safari, and Opera, and comprised almost half the identified vulnerabilities among the four browsers.

        If this is like most reports of the same type, they are using vendor-reported bugs. Firefox would, by definition, have the largest bug list by any stretch in such a report. They are the only web browser development team that allows (and encourages) access to the same bug-tracking database that their developers use. Safari, IE, and Opera only report vulnerabilities when (a) they have been fixed, or (b) when so many reports have come out that they finally have to 'fess up.

        • Re: (Score:3, Insightful)

          by SharpFang (651121)

          ActiveX is listed separately? Yay, that explains why MSIE fares so well.

          MSIE is a rather simple GUI built around the ActiveX HTML Browser control ("Trident" engine). So the exploits that affect all browsers that use it (IE, FF+IE Frame, Netscape, Maxthon, and a bunch of others) are simply listed as ActiveX exploits.Only exploits that are dependent on MSIE GUI layer are counted as MSIE ones.

          It's like they counted only XUL interface exploits for Firefox, treating Gecko rendering engine as a separate system wi

      • Re: (Score:3, Insightful)

        by roc97007 (608802)

        What makes this particularly bad is that vendors can improve their scores by neglecting to patch their browsers. The less responsible they are, the better their marketing numbers.

      • Re:I wonder (Score:5, Insightful)

        by Galestar (1473827) on Wednesday November 11, 2009 @02:47PM (#30063600)
        The PDF in the article is mostly marketing, and does not do much in the way of explaining how they arrived at those numbers other than; "Cenzic analyzed all reported vulnerability information from sources including NIST, MITRE, SANS, US-CERT, OSVDB as well as other third party databases for Web application security issues reported during the first half of 2009." We can therefore conclude that those numbers are based upon reported vulnerabilities, regardless of whether or not they were fixed. From my experience Firefox has a good habit of quickly patching security vulnerabilities. For example, there is the SSL spoof vulnerability discovered late July that Firefox fixed in 5 days and IE/Safari/Chrome still haven't fixed in over 3 months AFAIK) So there is nothing to indicate that Firefox is necessarily a less secure browser.
      • Haven't RTFA yet but I bet they are using patch notes as their source of vulnerabilities.

        So the headline should have been "Firefox most transparent browser when it comes to vulnerabilities".

        I'm no FF fanboi. I think they've gone off the rails in a lot of ways - especially by forcing users to accept changes that many changes they don't like such as AWFULBAR. However one thing they do right is they're transparent about bugs and vulnerabilities (at least once they're able to reproduce them). The whole article

    • Re: (Score:2, Insightful)

      by qoncept (599709)
      I get your point, but in the end, what is the difference? Many people are die hard users of the plugins (I use firefox and I'll never understand the hype) that they insist they could never go without them, and in many cases it's the primary force in their decision to use firefox.

      Anyway, allowing plugins to run that may have vulnerabilities is a vulnerability in itself.
      • Re:I wonder (Score:5, Insightful)

        by rudy_wayne (414635) on Wednesday November 11, 2009 @02:00PM (#30062832)

        I get your point, but in the end, what is the difference? Many people are die hard users of the plugins (I use firefox and I'll never understand the hype) that they insist they could never go without them, and in many cases it's the primary force in their decision to use firefox.

        You're confusing plugins with extensions.

      • Re:I wonder (Score:4, Informative)

        by cream wobbly (1102689) on Wednesday November 11, 2009 @02:23PM (#30063216)

        Before you go off on one (Well okay, you already went off on one), the report doesn't even mention plugins (or, for that matter, extensions). it just says (I quote) "Of the browser vulnerabilities, Firefox had 44 percent of the total, but perhaps the biggest surprise was Safari, which formed 35 percent of the browser vulnerabilities. Internet Explorer was third, with 15 percent, and Opera was at 6 percent."

        That's as much detail as you're going to get from these guys. They're too busy trying to sell you their "software and SaaS products to protect Websites against hacker attacks." They go on to explain that "Unlike network security and SSL solutions, Cenzic tests for security defects at the Web application level where over 75% of attacks occur. Our dynamic, black box testing of Web applications is built on a non-signature-based technology that enables us to find more “real” vulnerabilities."

        It's FUD, followed by a sales pitch.

    • by Anonymous Coward on Wednesday November 11, 2009 @02:13PM (#30063026)

      According to the report, as best I can determine, this is how they found their results:

      "Cenzic analyzed all reported vulnerability information from sources including NIST, MITRE, SANS, US-CERT, OSVDB, as well as other third party databases"

      It seems reasonable that any/all open source software would have a higher number of reports in these databases than proprietary software, simply because more people are able to publicly scan and report on vulnerabilities... by definition, open source software conducts it's business in public, while proprietary software does so behind it's private curtain.

    • Re:I wonder (Score:5, Interesting)

      by Nikker (749551) on Wednesday November 11, 2009 @02:57PM (#30063788)
      I actually RTFA and the vulnerabilities it accounts for are
      • SQL Injection 25%
      • XSS 17%
      • Web Server 2%
      • Buffer Errors 12%
      • Web Browser 8%
      • Authentication / Authorization 14%

      Plus a few under 10%. The funny thing is that the article seems to blame the browser for SQL Injection, Web Server, Information Leak / Disclosure? WTF?

      Information Leaks could be the result of any attack, SQL Injection has nothing at all to do with any browser and "Web Server"? There is no real information other than a nice shaded 3D pie chart so what this guy is trying to prove is beyond me. It also includes Path Traversal which is server side as well, code injection well injection into what? The browser, the server ... what?

      Popular vendors including Sun, IBM, and Apache continue to be among the top 10 most vulnerable Web applications named.

      Even if some agrees that these companies are actual web applications and not software companies, you would have to agree that there really are only about 10 commonly used web servers [netcraft.com] in total so Sun, IBM and Apache will be on this list regardless of the exploit.

      Looking at the real report [cenzic.com] all of the exploits blamed on the browsers are based on SQL Injections and propagating malicious code from the originator of the web site so how could one browser handle this more effectively then another? This doesn't really make a lot of sense so anyone gifted with more ability then myself please reply below.

      • Re:I wonder (Score:4, Interesting)

        by fredjh (1602699) on Wednesday November 11, 2009 @03:07PM (#30063980)

        I was wondering that myself... how is SQL injection a fault of the browser? I mean... I suppose a plugin could try SQL injections when submitting forms, but I don't see how that could be any worse on any other browser, AND it doesn't compromise the browser or the client's system.

      • Re: (Score:3, Insightful)

        by leonbloy (812294)

        The funny thing is that the article seems to blame the browser for SQL Injection...

        ...all of the exploits blamed on the browsers are based on SQL Injections and propagating malicious code from the originator of the web..

        No. "Vulnerabities in web aplications" is the total set, of which just 8% correspond to web browsers. (From that 8%, the 44% goes to Firefox) The remaining 92% are problems due to web servers and applications (phpMyAdmin, and so); SQL Injections among them. I agree with many other posters, though, in that the report is bullshit, just some graphs and no information about how the data was obtained.

  • Huh? (Score:5, Interesting)

    by Anonymous Coward on Wednesday November 11, 2009 @01:47PM (#30062660)

    So just down the page on slashdot, this very day, there are warnings about a "Windows kernel vulnerability" that is exploited through IE. I'll take three cross-site scripting bugs any day over a kernel level compromise, thank you.

    I know the world doesn't have a good objective measure of "impact" to assign to these things so that one could assess the total "probable inconvenience" of the presented security vulnerabilities, and that makes unbiased data gathering difficult, but this feels pretty absurd.

  • Certified (Score:5, Funny)

    by rwv (1636355) on Wednesday November 11, 2009 @01:48PM (#30062664) Homepage Journal

    It seems a bit surprising to me that this study shows that only 15% of vulnerabilities are in IE.

    There is an explanation for that.

    Cenzic Recognized as a Microsoft Certified Partner, Experiences Substantial Momentum in Q2 [cenzic.com]

  • In Cenzic's report [cenzic.com] that chart is entitled "Web Browser Vulnerabilities by Major Type" and web browsers are only given one page.

    I looked through older reports and cannot find a list of "vulnerabilities by major type." Anyone know where to find that? Until you can point that to me, I'm not going to take much stock in a company which has an ad on the bottom of the article that reads:

    Let us hack you before hackers do! The Cenzic website HealthCheck. FREE. Request yours now!

    I'm sure one major category is "Win32 kernel exploits" while every piece of Gecko and Webkit qualifies as one major type.

  • who is cenzic? (Score:5, Insightful)

    by bl8n8r (649187) on Wednesday November 11, 2009 @01:51PM (#30062728)

    Just another consultant hired to slant reality if you ask me.

    http://search.cert.org/search?q=advisory+internet+explorer [cert.org]
    http://search.cert.org/search?q=advisory+firefox [cert.org]

  • I have heard the case against Safari often.

    I have definitely found infected Firefox installations on relative machines. It's not immune because it is open source.

    What is the prevailing flaw that Firefox has? Are they like ActiveX scale flaws where they own the PC or are they more minor but still serious?

    • Well.... Firefox does not run its plugins in a sandbox, so they can run at whatever level FF was started at. Any plugin with a vulnerability would then give you as much access as you allow FF.
    • by Jaysyn (203771)

      What is the prevailing flaw that Firefox has? Are they like ActiveX scale flaws where they own the PC or are they more minor but still serious?

      Javascript.

      • I installed NoScript [noscript.net] recently along with Request Policy [requestpolicy.com]. One protects from any request to a foreign domain and one blocks scripts until I allow them.

        Have I reduced my exposure enough?

        What I want to see is a community mediated system whereby the whitelists and blacklists are distributed amongst the community. A bit like ThreatNet, SpyNet, PrevX and all the other proprietary security systems. How the decision of whether or not to allow or disallow a request will be made but it needs to be made by a massive co

    • Re: (Score:3, Interesting)

      by Anonymous Coward

      Its plugins. Ive seen several machines recently infected, no files were showing as having been downloaded, but based on the temp files used to start the infection it appears that Adobe Reader is being used quite a lot as an avenue for infection

    • Re: (Score:3, Insightful)

      Define "Infected Firefox installations"

      Maybe you mean "PC with Firefox installed thats infected by a {virus|trojan|keylogger|spyware}" ?

      Still, installing Firefox doesn't prevent you from catching something for running infected software or prevents someone from installing some crap that puts toolbars or BonziBuddy into your PC....

  • Nothing to see here (Score:3, Interesting)

    by El_Muerte_TDS (592157) <elmuerte@@@drunksnipers...com> on Wednesday November 11, 2009 @02:03PM (#30062876) Homepage

    From the report.

    Popular vendors including Sun, IBM, and Apache continue to be among the top 10 most vulnerable Web applications named.

    Wait... so vendors and now applications?
    They continue to say that Java and PHP are very vulnerable, but it's actually applications written in Java and PHP, not the language+runtime itself. In that case you could say that C++ has the most vulnerabilities.

  • So I'm reading this and these guys come across like goofs somewhat...

    Pg. 4 - says: "The top 10 vulnerabilities for the first half of 2009, included familiar names such as Sun, IBM, SAP, PHP, and Apache." which is according to page 7 the ones they classified as "as the most severe." whatever that means.

    But in page 6 they say: "Sun Java, PHP, and Apache continue to be among the Top 10 vendors having the most severe vulnerabilities for the first half of 2009."

    However in the whole top 10 list there are
  • I did not read the whole report but there is absolutely no mention of severity in that press release... nor does it mention how they counted them. Are these defects that have been acknowledged and fixed? From what I can see it's entirely possible that they've counted the THOUSANDS of trivial defects that Firefox discloses and fixes as a matter of course while Microsoft will only disclose the severe ones.
  • "Reported" bugs? (Score:5, Insightful)

    by Bluemumba (1320257) on Wednesday November 11, 2009 @02:23PM (#30063198)

    Isn't counting bugs released as part of press releases and change logs kind of like saying "All confirmed criminals are in jail?"

  • been using it since the 90s and from long experience can say it's the safest by far. don't know why or care particularly. whether clever code or minuscule market penetration is academic from this user's pov. truth is the fat lady's song still keeps the bad guys away.

  • by Hurricane78 (562437) <deleted AT slashdot DOT org> on Wednesday November 11, 2009 @02:25PM (#30063246)

    Comparing openly known vulnerabilities, and calling it "all in all vulnerability".
    As if they wouldn't know perfectly well, that Microsoft sends a cease and desist letter to anyone who is even talking about a vulnerability that is not official to MS.

    I guess the old saying is true, that:

    If you can't program, you teach.
    If you can't teach, you administrate.
    If you can't administrate, you report.
    If you can't report, you criticize.

    • Re: (Score:3, Insightful)

      by tool462 (677306)

      And to draw the chain to its conclusion:

      If you can't criticize, complain on Slashdot. :)

  • Yeah, I've pretty much stopped trusting anything that has to include pie charts in order to describe what needs to be demonstrated. How about puttin' some numbers in there, chief? And not made up numbers or percentages.
  • by Effugas (2378) * on Wednesday November 11, 2009 @02:33PM (#30063346) Homepage

    So, I'm posting as somebody who has gotten critical fixes pushed into both IE and Firefox. (Technically, Chrome and Opera too, but those were the pure crypto vulns.)

    It's genuinely hard to write a secure web browser. Forget plugins -- you have a complex internal object model, subject to all sorts of very fine grained rules ("the filename on an input type=file form must not be settable from Javascript"), which can be made into a pile of moving parts under the control of an attacker. What's happened somewhat recently is a lot more people have gotten into bashing Firefox. You know those "many eyes" theories of open source, and how they're usually kind of full of it?

    Well, "many eyes" are visiting it now, and Mozilla to their credit is doing a lot of very hard work to deal with the influx. Good on them.

  • by Em Ellel (523581) on Wednesday November 11, 2009 @02:45PM (#30063566)

    Anyone else notice that the so called "study" is actually a marketing material for some SaaS product? If you like that there are some great whitepapers out there... LOL.

    its a joke - they just downloaded some bug reports, made some pretty graphs and called it a report. I will bet you the person putting it together could not explain what a "web browser vulnerability" is - other than something that should scare people to buy their product.

  • by Chris Daniel (807289) on Wednesday November 11, 2009 @02:46PM (#30063574) Homepage
    Glossy, primary colours, circles ... reminds of the Chrome logo.
  • by bfree (113420) on Wednesday November 11, 2009 @02:53PM (#30063720)

    Lots of comments mentioning the lack of taking into account of the severity of the bugs, but what about the duration of the vulnerabilities. Or to extend that train of thought, if IE has a current known exploit (or collection of them) there's not as much incentive to go finding another one if you know the one you have won't be closed for another few weeks/months anyway. I suspect with firefox any hole found will be fixed with a released patch far more quickly (and as others mentioned, possibly before any exploits are known of) so you have to keep finding new ones if you want to use firefox as a way in to a machine.

    In summary, FUD off

    • Re: (Score:3, Insightful)

      by swillden (191260)

      Lots of comments mentioning the lack of taking into account of the severity of the bugs, but what about the duration of the vulnerabilities.

      Agreed. The most accurate way to assess vulnerability based on reported security defects is to categorize them by severity and then total up days of vulnerability by category. Additional weight should be given to vulnerabilities with a released exploit.

  • SQL injection? (Score:3, Interesting)

    by rrohbeck (944847) on Wednesday November 11, 2009 @03:16PM (#30064146)

    The top vulnerability is SQL injection.
    Can anybody explain how the browser is responsible for SQL injection vulns?

  • by DdJ (10790) on Wednesday November 11, 2009 @03:20PM (#30064208) Homepage Journal

    It seems a bit surprising to me that this study shows that only 15% of vulnerabilities are in IE.

    Well. Remember that "the front door is unlocked, the guard has been dosed with chloral hydrate, and there's a loaded shotgun just laying there on the credenza" could collectively be called one single vulnerability. Quantity doesn't trump quality!

  • by gcatullus (810326) on Wednesday November 11, 2009 @03:47PM (#30064624)

    Well I actually looked at the pdf report. It starts off with "What do the swine flu and hackers have in common". That started to get a laugh, but then the executive summary says that web vulnerabilities are getting better because of Obama. How can anyone take this seriously??

  • by seifried (12921) on Wednesday November 11, 2009 @04:17PM (#30065018) Homepage
    The fundamental flaw of all these studies is that they are NBOT measuring vulnerabilities, they are measuring PUBLIC vulnerabilities. Two very different things.
  • sloppy (Score:3, Insightful)

    by mr.dreadful (758768) on Wednesday November 11, 2009 @04:35PM (#30065264)
    "Cenzic analyzed all reported vulnerability information from sources including NIST, MITRE, SANS, US-CERT, OSVDB, OWASP, as well as other third party databases for Web application security issues reported during the first half of 2009." Ah -- the old "count the number of bug reports" technique. I won't even bother ranting about that
  • Microsoft is reeling from the vicious and unwarranted slanders of security companies and the US government’s Computer Emergency Response Team that its Internet Explorer web browser has alleged “security holes” or is in any way less than the finest software known to mankind [today.com] and excellent value for your money. "Cenzic proves it's Firefox! FIREFOX DID IT! Fuckers."

    The festering paedophiles of CERT have gone so outrageously far as to make the ludicrous claim that just viewing a malicious webpage in IE could leave your computer open to being hacked and turned into a Russian Mafia spam server. “We don’t know what could have triggered such vindictiveness,” sobbed Microsoft marketing marketer’s marketer Steve Ballmer. “Do they hate free enterprise that much?”

    There are things you can do to make your computing experience even more secure. Microsoft’s official suggestion — make sure your anti-virus software is up to date and using an entire CPU doing nothing much, click through five screens to run IE in “protected mode,” click through four screens to set zone security to “high,” click “JUST BLOODY DO IT WILL YOU” when the User Access Control asks if you really want to do this, enable automatic updates with the minor side-effect of installing Microsoft DRM on your system or Windows Genuine Advantage randomly turning your computer into a paperweight, and sacrifice a goat to Microsoft at midnight on a moonless night — is simple and straightforward. “It’s the quality you’re paying for.”

    On no account should you consider that there might be other web browsers out there, as researchers have demonstrated that all of them automatically download the cover of Virgin Killer. “I saw a report,” said marketing marketer John Curran of Microsoft Completely Enderlependent Analysts, Inc., “that another browser had more vulnerabilities than ours! People would be very foolish indeed to move from the latest IE to Netscape 4.01.”

    “These CERT wankers are Mactards and trolls,” said Guardian marketing marketer Jack Schofield. “They just want to take IE users out, brutally sodomise them, gas them in concentration camps and” [This comment has been removed by a Guardian moderator. Replies may also be deleted.]

After an instrument has been assembled, extra components will be found on the bench.

Working...