MS, Apple, Oracle Are Top Vulnerable Vendors

New IBM research shows that five vendors are responsible for 12.6 percent of all disclosed vulnerabilities.

Not surprising: In the first half of 2007, Microsoft was the top vendor when it came to publicly disclosed vulnerabilities. Likely surprising to some: Apple got second place.

IBM Internet Security Systems' X-Force R&D team released its 2007 report on cyber attacks on Sept. 17, revealing that the top five vulnerable vendors accounted for 12.6 of all disclosed vulnerabilities in the first half of the year—or 411 of 3,272 vulnerabilities disclosed.

Here's the order in which the top 10 vendors stacked up, by percentage of vulnerabilities publicly disclosed in the first half of the year:

Microsoft, 4.2 percent
Apple, 3 percent
Oracle, 2 percent
Cisco Systems, 1.9 percent
Sun Microsystems, 1.5 percent
IBM, 1.3 percent
Mozilla, 1.3 percent
XOOPS, 1.2 percent
BEA, 1.1 percent
Linux kernel, 0.9 percent

The report also says that 21 percent of vulnerabilities disclosed by the top 5 vendors remain unpatched—up from a year ago, when only 14 percent of the top vendors' vulnerabilities stayed open in the same timeframe.

While that might seem alarming, it's notable that 60 percent of vulnerabilities from all other vendors found in the first half of the year remained unaddressed.


The vast majority—90 percent—of the 3,273 vulnerabilities reported in the first half of the year can be exploited remotely. And more than half—51.6 percent—of the vulnerabilities found would give an attacker access to the host after exploitation.

In other findings, one surprise was that for the first time ever, there's been an actual decrease in the number of vulnerabilities reported. The total of 3,273 vulnerabilities found represents a 3.3 percent decrease over the first half of 2006.

X-Force Director Kris Lamb told eWEEK that there are a few things at play that likely have contributed to the decrease. One factor is that nowadays researchers have at their disposal much more polished bug-finding techniques. One such technique is fuzzing: the use of automatic tools to find vulnerabilities.

As such tools become more mainstream, Lamb said, we are likely hitting the saturation point as far as finding the low-hanging fruit goes.

"[The functionality of] tools are still being expanded, but they were used in early years to find easier-to-find, medium- and high-[risk] vulnerabilities," he said. "It doesn't mean there aren't more bugs to be found, but the bugs out there are harder to find, and they take a more specialized skill set to find."

The decrease in reported vulnerabilities could also be a reflection of the trend to monetize exploits in the underground marketplace—and in the above-ground marketplace as well. The disclosure of bugs could be taking longer since they're being sold or traded, he suggested, on sites such as Wabisabilabi, an eBay-like bug market launched in July.

"There's the potential for vulnerabilities to not see the light of day either as quickly as they used to or [at all], as a result," Lamb said.

Where spam and phishing is concerned, X-Force found that the top spam spewers worldwide are the United States, Poland and Russia. Analysis of IBM ISS' content filtering services and the millions of e-mail addresses it actively monitors shows that the United States accounts for originating one-eighth of all worldwide spam. Here's how the rest of the world breaks down, spam sender-wise:

United States, 13.2 percent
Poland, 7.1 percent
Russia, 5.9 percent
Germany, 5.9 percent
South Korea, 5.7 percent
China, 5.4 percent
Brazil, 4.5 percent
Italy, 4.0 percent
France, 3.8 percent
Turkey, 3.0 percent

But the map of where spam URLs are hosted looks very different. The United States is still tops in this category—it's home to 34.7 percent of the points from which spam URLs are hosted—but the rest of the world breaks down differently, with China moving to its usual position at or near the top of such maps:

United States, 34.7 percent
China, 12.7 percent
South Korea, 5.9 percent
France, 5.3 percent
Hong Kong, 3.6 percent
Canada, 2.9 percent
United Kingdom, 2.6 percent
Russia, 2.6 percent
Hungary, 2.2 percent
Netherlands, 2 percent

The X-Force is also seeing a first-time dip in byte size for spam. This is a trend that reflects the decrease in image-based spam, as senders hop around in an effort to avoid content filters by instead sending spam messages embedded in PDFs, Excel or other file formats, Lamb said.

"That's very effective, initially, at bypassing a lot of traditional filtering technology," Lamb said.

Author: Lisa Vaas @ eweek.com

Read more ...