Third-party software bugs skyrocket in 2010
Lack of auto-patching tools leaves Windows users vulnerable to attack, says Secunia
Computerworld - A surge in third-party software vulnerabilities accounted for the bulk of a ballooning bug count in the first half of 2010, said Danish security firm Secunia today.
The increasing number of flaws uncovered in non-Microsoft software puts users at risk because few third-party vendors offer automated update services, requiring people to seek out updates, then manually download and install patches.
"We were astonished to see the extent of the vulnerabilities in third-party software," said Stefan Frei, research analyst director at Copenhagen-based Secunia. "The jump in vulnerabilities was almost exclusively due to third-party applications, not Microsoft's."
Frei analyzed Secunia's vulnerability database -- the company is best known for tracking bugs and issuing advisories -- and collected information on the average Windows PC's application inventory using Secunia's PSI (Personal Software Inspector). PSI is a free tool that scans PCs to produce a list of vulnerable software.
Secunia came up with a list of the top 50 programs in the average PC's software portfolio, tallied the vulnerabilities in those applications that were revealed in the first half of 2010, used those numbers to estimate the year's total, and then compared them with bug counts going back to 2005.
The results were striking. "This analysis clearly identifies vulnerabilities from third-party programs to be almost exclusively responsible for the increasing [vulnerability count] trend observed since 2007," Frei said in a report he published today (download PDF). "Data from the first half of 2010 shows that third-party program vulnerabilities are the primary risk factor for typical end-user PCs."
While vulnerabilities in Windows XP and Vista will climb by 31% and 34%, respectively, this year compared to 2009, bugs in third-party software will jump by 92%, in other words, nearly double last year's number.
Of the total increase in vulnerabilities that a Windows XP user will likely face throughout all of 2010, 79% can be traced to third-party programs, not Windows or other Microsoft software, such as Internet Explorer or Office.
Secunia's conclusion mirrors that of other security firms this year. Antivirus vendors McAfee and Symantec have both reported large surges in attacks exploiting bugs in Adobe's Reader, for example, one of the most widely-installed third-party browser plug-ins. McAfee, for example, said that exploits of Reader jumped 65% in the first quarter of 2010 compared to all of 2009.
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts