Firefox tops list of 12 most vulnerable apps


Recommended Posts

Firefox tops list of 12 most vulnerable apps

Posted by Ryan Naraine @ 10:41 am

Mozilla?s flagship Firefox browser has earned the dubious title of the most vulnerable software program running on the Windows platform.

According to application whitelisting vendor Bit9, Firefox topped the list of 12 widely deployed desktop applications that suffered through critical security vulnerabilities in 2008. These flaws exposed millions of Windows users to remote code execution attacks.

The other applications on the list are all well-known and range from browsers to media players, to VOIP chat and anti-virus software programs. Here?s Bit9?s dirty dozen:

  1. full report (.pdf) for information on how the list was put together, including criteria for iSource:
ZDNet4"]ZDNet[/url]

It's not the most vulnerable app, these are holes that have been closed, since it has no holes at the moment it is equally arguable that its the most secure app. Annoyed at post title, change to List of 12 most secured apps. Secured suggests work has been done to lock apps down to keep them secure.

It's not the most vulnerable app, these are holes that have been closed, since it has no holes at the moment it is equally arguable that its the most secure app. Annoyed at post title, change to List of 12 most secured apps. Secured suggests work has been done to lock apps down to keep them secure.

Mmmmm.....They seem to have forgotten Internet Explorer. IE is worst than Mozilla. Also. seems to me every major browser, except Opera, has an issue. You don't want viruses executed on Mozilla? Install the NoScript add-on. As simple as that. And if you are still doubtful, disable Javascript entirely and stay away from Warez and porn sites!

Microsoft: Bit9, come here.

Bit9: Microsoft, what do you want?

Microsoft: Well, we have some cash to give you.

Bit9: Why would you give us cash, what's the catch?!

Microsoft: When you bring out your list, please do not put IE on there, but say Mozilla's Firefox has lots of issues.

Bit9: Okay, we'll do it!

Microsoft: Bit9, come here.

Bit9: Microsoft, what do you want?

Microsoft: Well, we have some cash to give you.

Bit9: Why would you give us cash, what's the catch?!

Microsoft: When you bring out your list, please do not put IE on there, but say Mozilla's Firefox has lots of issues.

Bit9: Okay, we'll do it!

Why post something like this? Go get the facts and come back and prove the article is wrong. You can do that right? Why would they include messenger, but not IE?

I know no one will even bother replying to my post, but thats fine, because I know you wont be able to provide the facts for what you claim, and by not responding just proves me right.

This kind of comparison is completely invalid for one simple reason: Different vendors have different disclosure practices. Since I'm most familiar with Mozilla and Firefox I use them as an example, Mozilla does full disclosure on all their security issues, IE/Opera/Safari only reveal security issues that were found by 3rd party researchers. Since over half of all Firefox security issues are found by in-house staff, it's logical to assume that other vendors find even more of their security issues (especially the ones that are closed source). Hence this kinda of comparison favors heavily vendors that have poor security policies.

Did you guys EVEN bother to read the .PDF file? I will take that as a NO.

The applications on this list meet the following criteria.

1)Runs on Microsoft Windows.

2)Is well-known in the consumer space and frequently downloaded by individuals.

3)Is not classified as malicious by enterprise IT organizations or security vendors.

4)Contains at least one critical vulnerability that was:

a. first reported in January 2008 or after,

b. registered in the U.S.National Institute of Standards and Technology?s (NIST) official vulnerability database at http://nvd.nist.gov,and

c. given a severity rating of high (between 7.0-10.0) on the Common Vulnerability Scoring System (CVSS).

5)Relies on the end user,rather than a central administrator,to manually patch or upgrade the software to eliminate the vulnerability,if such a patch exists.

6)The application cannot be automatically and centrally updated via free Enterprise tools such as Microsoft SMS & WSUS.Note that in most cases,the vendors of these applications have issued patches or other instructions for eliminating the vulnerability. But the nature of these applications is such that the user is responsible for implementing the patch.Enterprise IT organizations can not reliably ensure these patches have been properly applied?if at all representing an inherent exposure in protecting the enterprise network.

Finally,the applications on the list have been ranked according to the popularity of the application,number and severity of vulnerabilities, and difficulty of detection and/or patching by central IT.

3) Monitor the Internet for new vulnerabilities.

4) Monitor your PCs using soft- ware identification services.

5) Enforce application controls using Bit9 Parity.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Ummmm that is what is it supposed to do. Just turn if off in settings if you do not want it analyzing your open tabs. Chrome does the same thing with Gemini. Sarfari will do the samething after Apple's AI and even more so with the release of their 27 versions that is now powered by Googles LLM/ML models. Understanding why it is doing it and how it can help you vs jumping to some conspiracy theroy is a much better approach. As long as it can be turned off, all is good. Yes the default should be off but the a lot of people would never discover these features.
    • Just another reason (aside from many others) not to use Edge. Firefox 153.0b5 DEx64 has a similar feature added recently in prior builds that I will turn off at some point when I get around to it. It's the new "Something looks suspicious" page that pops up here and there. It cleverly hides itself between web pages that I've actually visited; as a result, you know, of selecting a web page and telling the browser where to go. The interesting thing is that it does not produce these warnings from pages that I, as the only intelligent user of the browser in my system, have ever directed the browser to open! What seems to be happening is that the browser looks at all the goofy ad links on a web page I do actually open and selects one that "looks suspicious" and then creates the "something looks suspicious" web page, which is neatly inserted, as mentioned, between web pages my RB ("real brain") has directed the browser to load in a session. The thing is, I usually look at links I am considering to follow before I ask the browser to load them, and in cases I have noticed where the link does indeed look suspicious, most of the time I will choose to not follow the link at all. Doesn't everyone do this or something similar? I am picky about what I voluntarily load... (I don't like links that start off fine, with a site designaiton that seems normal enough but then is followed by indecipherable alphanumeric strings many, many lines long, etc. I tend to reject those because they look suspicious. They may not be, but I don't care... I'll stay with Firefox, of course, if for no other reason than they usually let you turn off the junk you don't like. And because it isn't Edge... But at some point Microsoft will come to realize that putting your bookmarks on the left side is a Good Thing for a lot of people, just as Microsoft discovered when it had the bright idea of nailing the Windows taskbar to the bottom of the screen, when for decades Microsoft browsers had left that placement up to the user. They have finally reversed the obscenity of that decision. Finally.
    • Google was using the old CATPCHAs data to train their LLMs. What is the say they won't use this camera data of users to train their LLM? these companies need some strict regulations!
    • Depends on what you need. Might be a bit clearer on what you plan to do with it. Sort of a waste if you get the newest and greatest, but don't know how to use it.
  • Recent Achievements

    • One Year In
      BA the Curmudgeon earned a badge
      One Year In
    • Conversation Starter
      rosiecharles earned a badge
      Conversation Starter
    • First Post
      KMilenkoski1202 earned a badge
      First Post
    • First Post
      carols23 earned a badge
      First Post
    • One Month Later
      Tom Willson earned a badge
      One Month Later
  • Popular Contributors

    1. 1
      +primortal
      513
    2. 2
      +Edouard
      258
    3. 3
      PsYcHoKiLLa
      151
    4. 4
      Steven P.
      94
    5. 5
      macoman
      66
  • Tell a friend

    Love Neowin? Tell a friend!