Forgot your password?
Mozilla Security The Internet IT Technology

Firefox Most Vulnerable Browser, Safari Close 369

Posted by CmdrTaco
from the say-what-now dept.
An anonymous reader writes "Cenzic released its report revealing the most prominent types of Web application vulnerabilities for the first half of 2009. The report identified over 3,100 total vulnerabilities, which is a 10 percent increase in Web application vulnerabilities compared to the second half of 2008. Among Web browsers, Mozilla Firefox had the largest percentage of Web vulnerabilities, followed by Apple Safari, whose browser showed a vast increase in exploits, due to vulnerabilities reported in the Safari iPhone browser." It seems a bit surprising to me that this study shows that only 15% of vulnerabilities are in IE.
This discussion has been archived. No new comments can be posted.

Firefox Most Vulnerable Browser, Safari Close

Comments Filter:
  • Huh? (Score:5, Interesting)

    by Anonymous Coward on Wednesday November 11, 2009 @01:47PM (#30062660)

    So just down the page on slashdot, this very day, there are warnings about a "Windows kernel vulnerability" that is exploited through IE. I'll take three cross-site scripting bugs any day over a kernel level compromise, thank you.

    I know the world doesn't have a good objective measure of "impact" to assign to these things so that one could assess the total "probable inconvenience" of the presented security vulnerabilities, and that makes unbiased data gathering difficult, but this feels pretty absurd.

  • Re:I wonder (Score:1, Interesting)

    by Anonymous Coward on Wednesday November 11, 2009 @01:49PM (#30062692)

    Doesn't matter. If the browser cannot protect itself from its own add-ons then it is still the browser at fault.

    Glad I don't use Firefox, Safari or IE.

  • Re:I wonder (Score:4, Interesting)

    by dkleinsc (563838) on Wednesday November 11, 2009 @01:55PM (#30062772) Homepage

    So in other words, this isn't a count of how many vulnerabilities there are, it's a count of how many vulnerabilities are found and fixed.

    Something tells me their methodology is a bit flawed. Of course, that's by design, given Cenzic's financial ties to Microsoft.

  • Nothing to see here (Score:3, Interesting)

    by El_Muerte_TDS (592157) <elmuerte AT drunksnipers DOT com> on Wednesday November 11, 2009 @02:03PM (#30062876) Homepage

    From the report.

    Popular vendors including Sun, IBM, and Apache continue to be among the top 10 most vulnerable Web applications named.

    Wait... so vendors and now applications?
    They continue to say that Java and PHP are very vulnerable, but it's actually applications written in Java and PHP, not the language+runtime itself. In that case you could say that C++ has the most vulnerabilities.

  • Re:I wonder (Score:5, Interesting)

    by Shatrat (855151) on Wednesday November 11, 2009 @02:05PM (#30062898)
    lol, touche.
    Still, do you really have to read it?
    It seems like one of these bootlicking/astro-turfing 'studies' from some consulting agency or 'solution' vendor comes along about every 6 months in the Slashdot headlines.
    Upon reading TFA, this one seems no more credible than any other.
  • by Anonymous Coward on Wednesday November 11, 2009 @02:09PM (#30062964)

    Its plugins. Ive seen several machines recently infected, no files were showing as having been downloaded, but based on the temp files used to start the infection it appears that Adobe Reader is being used quite a lot as an avenue for infection

  • Re:I wonder (Score:2, Interesting)

    by bangthegong (1190059) on Wednesday November 11, 2009 @02:13PM (#30063030)
    a much more credible report, IMO because they are at least honest about their methodology and the weaknesses or strengths of how to look at different data: []
  • Re:I wonder (Score:4, Interesting)

    by noidentity (188756) on Wednesday November 11, 2009 @02:23PM (#30063214)
    Wow, so if I merely released my own binary-only build of Firefox and never mentioned any fixed vulnerabilities in release notes, this study would have found it with far fewer vulnerabilities than Firefox? I think I found a vulnerability in this study...
  • Re:I wonder (Score:2, Interesting)

    by Anonymous Coward on Wednesday November 11, 2009 @02:30PM (#30063294)
    Hypocrisy? He didn't say anything about the article. All he said was that the previous two posters made conclusions based on absolutely nothing.
  • by Effugas (2378) * on Wednesday November 11, 2009 @02:33PM (#30063346) Homepage

    So, I'm posting as somebody who has gotten critical fixes pushed into both IE and Firefox. (Technically, Chrome and Opera too, but those were the pure crypto vulns.)

    It's genuinely hard to write a secure web browser. Forget plugins -- you have a complex internal object model, subject to all sorts of very fine grained rules ("the filename on an input type=file form must not be settable from Javascript"), which can be made into a pile of moving parts under the control of an attacker. What's happened somewhat recently is a lot more people have gotten into bashing Firefox. You know those "many eyes" theories of open source, and how they're usually kind of full of it?

    Well, "many eyes" are visiting it now, and Mozilla to their credit is doing a lot of very hard work to deal with the influx. Good on them.

  • Re:I wonder (Score:5, Interesting)

    by Nikker (749551) on Wednesday November 11, 2009 @02:57PM (#30063788)
    I actually RTFA and the vulnerabilities it accounts for are
    • SQL Injection 25%
    • XSS 17%
    • Web Server 2%
    • Buffer Errors 12%
    • Web Browser 8%
    • Authentication / Authorization 14%

    Plus a few under 10%. The funny thing is that the article seems to blame the browser for SQL Injection, Web Server, Information Leak / Disclosure? WTF?

    Information Leaks could be the result of any attack, SQL Injection has nothing at all to do with any browser and "Web Server"? There is no real information other than a nice shaded 3D pie chart so what this guy is trying to prove is beyond me. It also includes Path Traversal which is server side as well, code injection well injection into what? The browser, the server ... what?

    Popular vendors including Sun, IBM, and Apache continue to be among the top 10 most vulnerable Web applications named.

    Even if some agrees that these companies are actual web applications and not software companies, you would have to agree that there really are only about 10 commonly used web servers [] in total so Sun, IBM and Apache will be on this list regardless of the exploit.

    Looking at the real report [] all of the exploits blamed on the browsers are based on SQL Injections and propagating malicious code from the originator of the web site so how could one browser handle this more effectively then another? This doesn't really make a lot of sense so anyone gifted with more ability then myself please reply below.

  • Details? (Score:2, Interesting)

    by Alerius (851519) on Wednesday November 11, 2009 @02:59PM (#30063824)

    So I *did* RTFA and found it was fluff. So I read the linked PDF report to try and find out some details on what these gaping security holes in my favourite browser actually were. I did not want to have to eat crow over my repeated recommendations to us Firefox over IE because it was more secure. Well, there's plenty of space dedicated to reporting server side vulnerabilities, plenty on web apps, lots of repetition of how surprised they were to find Firefox and Safari so vulnerable...but nothing on what vulnerabilities. No mention of types of vulnerability, frequency, core browser, plug-ins, add-ins, versions, ZIP!

    The 29 page report has one page that is mostly taken up with a lovely colourlful exploded pie chart. There is more space dedicated to advertising the Cenzic products and services than there is referencing browser vulnerabilities.

    This is isn't a report, it's a sales pitch.

  • Re:I wonder (Score:4, Interesting)

    by fredjh (1602699) on Wednesday November 11, 2009 @03:07PM (#30063980)

    I was wondering that myself... how is SQL injection a fault of the browser? I mean... I suppose a plugin could try SQL injections when submitting forms, but I don't see how that could be any worse on any other browser, AND it doesn't compromise the browser or the client's system.

  • SQL injection? (Score:3, Interesting)

    by rrohbeck (944847) on Wednesday November 11, 2009 @03:16PM (#30064146)

    The top vulnerability is SQL injection.
    Can anybody explain how the browser is responsible for SQL injection vulns?

  • Re:I wonder (Score:5, Interesting)

    by http (589131) on Wednesday November 11, 2009 @03:26PM (#30064296) Homepage Journal
    Pardon my ignorance, but how exactly is Cenzic tied financially to Microsoft again? Google's got nothing (and bing has less).
  • Re:I wonder (Score:3, Interesting)

    by wealthychef (584778) on Wednesday November 11, 2009 @03:34PM (#30064426)
    I wonder what difference it makes that there are more or less vulnerabilities reported. What actually matters is the total exposure, which I would define, for each browser, as
    the sum over all vulnerabilities of:
    (number of browsers with vulnerability) x (damage possible if vulnerability is exploited) x (chance of actually exploiting the vulnerability).
  • by syousef (465911) on Wednesday November 11, 2009 @03:56PM (#30064748) Journal

    Haven't RTFA yet but I bet they are using patch notes as their source of vulnerabilities.

    So the headline should have been "Firefox most transparent browser when it comes to vulnerabilities".

    I'm no FF fanboi. I think they've gone off the rails in a lot of ways - especially by forcing users to accept changes that many changes they don't like such as AWFULBAR. However one thing they do right is they're transparent about bugs and vulnerabilities (at least once they're able to reproduce them). The whole article is a fucking troll.

  • Re:who is cenzic? (Score:2, Interesting)

    by Silfax (1246468) on Wednesday November 11, 2009 @04:21PM (#30065074)
  • Re:I wonder (Score:3, Interesting)

    by Barny (103770) <> on Wednesday November 11, 2009 @05:39PM (#30066016) Homepage Journal

    Possibility that if the majority of the document is on server level stuff, then did they maybe test IE with "enhanced protection" that comes with server? Effectively its like firefox with no-script but has none of the user-friendliness of no-script.

  • Re:I wonder (Score:3, Interesting)

    by kestasjk (933987) * on Wednesday November 11, 2009 @08:00PM (#30067632) Homepage
    I'm a firefox user and I accept this study and that IE8 may well be more secure. They have made huge leaps in security since IE6, using sandboxing and whatnot to lessen the impacts of vulnerabilities found as well, and their security zone settings allow fine-grained choices regarding how secure you want to be vs what you need to run, and the integration with Active Directory allows security policy to be spread across enterprises easily.
    Firefox is much more tuned to individual users, and needs extra plugins like NoScript to give rudimentary access level controls.

    But Firefox supports the latest and greatest web standards, has a real community of users which make great plugins like NoScript and Adblock and Firebug, and is always trying new things like the awesome bar. If I wanted tin-foil-hat level security I'd use IE8 with a restrictive security policy, but realistically these days the difference between highly secure and pretty-damned-secure isn't that great; you're more likely to get a virus by being a dumbass and installing something you shouldn't than from an actual web-browser vulnerability.

    I do think trying to find flaws in the study and questioning the motives when it doesn't look favorably on your favorite browser, as most people here are doing, is just narrow minded and petty.
  • Re:I wonder (Score:3, Interesting)

    by Hatta (162192) on Thursday November 12, 2009 @12:15PM (#30073754) Journal

    From what I understand the report was based on the number of vulnerabilities patched, not announced

    The pdf of the report is linked from the article. Browser vulnerabilities are mentioned on only one page, on which no methodology is discussed. Most of the article has to do with web applications. For the web applications, they repeatedly use the term "reported vulnerabilities", not patched. They do discuss that the number of actual vulnerabilities may be lower than reported vulnerabilities for proprietary web applications. I'd bet they're using reported vulnerabilities for browsers too. Here is the entire text of the section on Web Browser Vulnerabilities:

    Vulnerabilities in Web browsers were concentrated among four popular technologies -
    Internet Explorer, Mozilla Firefox, Opera, and Safari. The number of browser
    vulnerabilities in first half of 2009 comprised about 8 percent of total Web vulnerabilities.
    Mozilla Firefox had the largest percentage at 44 percent. What was surprising was that
    the Safari browser had a lot more vulnerabilities at 35 percent this time around mainly
    due to vulnerabilities reported in iPhone Safari. Internet Explorer was third at 15 percent
    and Opera with six percent of total browser vulnerabilities.

    So this report is entirely useless. They don't discuss their methodology, which is likely to be suspect. Ignore it.

UNIX is many things to many people, but it's never been everything to anybody.