Other Unpatched Flaws
Email
Print
Miller did not use two other
unpatched vulnerabilities in Safari, also revealed just days after the
browser was released. The first is a pretty simple overflow; all one need do is
download a ZIP file with an overly long file name, and it allows code
execution. The second allows injection of content in a window belonging to a
trusted site.
Then a
Slashdot thread reported on research that confirms other research that
indicates Apple issues patches for known vulnerabilities more slowly than
Microsoft, with the result that there are more unpatched vulnerabilities on
Apple platforms.
In January, Microsoft's
Jeff Jones issued a report comparing vulnerability disclosures and patches on
several desktop OS platforms, including OS X 10.4 and Vista.
One year after Vista's release, Microsoft had fixed 36
vulnerabilities over a total of nine patching events, and 30 unpatched
vulnerabilities remained. In the first year of OS X 10.4, Apple fixed a total
of 116 vulnerabilities over 17 patching events, and at the end there were 41
unpatched vulnerabilities.
And the data doesn't stop there. In the week of March 17, Apple
issued another one of its massive
security updates, covering 87 different vulnerabilities (as measured by the
CVE numbers). Of those 87 vulnerabilities, 44 have CVE numbers from 2007, four
from 2006 and two from 2005. The oldest of these, CVE-2005-3352,
was fixed by
Apache in 2005. So I have no trouble believing that Apple is slower than a
turtle in the tar pits, let alone Microsoft.
And yet the Mac continues not to be widely attacked in the
real world. With their reputation among security professionals taking a
nosedive and malware
for the Mac on the increase, things could change real soon. Unless all that
talk of the Mac market share increasing is just hot air.
Security Center
Editor Larry Seltzer has worked
in and written about the computer industry since 1983.
For insights on security coverage around the Web, take a look at eWEEK.com
Security Center Editor Larry Seltzer's blog Cheap Hack.
