Feeds

Firefox flaws make up 44% of all browser bugs?

But numbers game ignores the big picture

Combat fraud and increase customer satisfaction

Updated Firefox flaws accounted for nearly half (44 per cent) of all browser bugs in the first half of 2009 - according to a survey which fails to factor in the seriousness of browser flaws.

A study by web application security firm Cenzic makes a decent fist of providing an overview of server-side web, but blots its copy-book with a brief foray into commenting on browser bugs. Of the browser vulnerabilities mapped by Cenzic, Firefox racked up 44 per cent of the total, with Safari bugs making up a 35 per cent slice of the browser vulnerabilities. Internet Explorer was third, with 15 per cent, with Opera copping for six per cent.

Cenzic's one-paragraph treatment of browser security suggests the number of Safari bugs was mainly due to vulnerabilities reported in iPhone Safari, and not much else. In particular, Cenzic fails to mention that the seriousness of flaws and the availability of exploits has a big bearing on how comparatively safe a browser choice might turn out to be.

The majority of media reports on Cenzic's survey fail to make the point that counting vulnerabilities alone is a bit pointless.

"For a proper and fair comparison one needs to dig a lot deeper than just looking at the numbers," Thomas Kristensen, CTO on web security notification firm Secunia, told El Reg.

"Other factors need to be taken into account for a proper comparison; this includes the type of vulnerabilities and thus the underlying type of coding errors, the impact of the vulnerabilities, the time it takes the vendor to fix the reported vulnerabilities, how easy it is to update the software thus how quickly the users (learn about and is able to) apply the patches.

"One may also want to look at the general design of the product, the efforts invested in improving the code and conducting internal security reviews and quality assurance, the usability with regards to certain security related features, the handling of plug-ins (how easy is it to lure the user into installing untrusted plug-ins) and so on," Kristensen concludes.

Lars Ewe, CTO of Cenzic, responded to queries from El Reg by saying it will consider highlighting the severity levels of bugs in future versions of its study. Ewe added that Cenzic supports Firefox in its product, which he personally uses as a default browser, so there's anti-Mozilla agenda in its report and certainly no "finger pointing".

The release of Cenzic's report coincided with Firefox's fifth anniversary on Monday, though this is probably a slightly unfortunate coincidence. The vast majority of the 29-page study concentrates on server-side flaws, drawing on data from enterprise use of Cenzic's managed security assessment services and work by its security researchers.

This section of the report (pdf) is far more detailed.

Of 3100 reported vulnerabilities, an increase of over ten per cent, more than three in four (78 per cent) involved web vulnerabilities. Many web applications continue to be vulnerable to information leaks, cross site scripting (XSS), authentication flaws and session management problems. Flaws in commercial applications, SQL Injection, and XSS dominated the threat landscape surveyed by Cenzic. ®

Combat fraud and increase customer satisfaction

More from The Register

next story
Android engineer: We DIDN'T copy Apple OR follow Samsung's orders
Veep testifies for Samsung during Apple patent trial
This time it's 'Personal': new Office 365 sub covers just two devices
Redmond also brings Office into Google's back yard
Batten down the hatches, Ubuntu 14.04 LTS due in TWO DAYS
Admins dab straining server brows in advance of Trusty Tahr's long-term support landing
Microsoft lobs pre-release Windows Phone 8.1 at devs who dare
App makers can load it before anyone else, but if they do they're stuck with it
Half of Twitter's 'active users' are SILENT STALKERS
Nearly 50% have NEVER tweeted a word
Internet-of-stuff startup dumps NoSQL for ... SQL?
NoSQL taste great at first but lacks proper nutrients, says startup cloud whiz
Windows 8.1, which you probably haven't upgraded to yet, ALREADY OBSOLETE
Pre-Update versions of new Windows version will no longer support patches
Microsoft TIER SMEAR changes app prices whether devs ask or not
Some go up, some go down, Redmond goes silent
Red Hat to ship RHEL 7 release candidate with a taste of container tech
Grab 'near-final' version of next Enterprise Linux next week
Ditch the sync, paddle in the Streem: Upstart offers syncless sharing
Upload, delete and carry on sharing afterwards?
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.