Posted on 09/19/2005 7:01:42 PM PDT by Incorrigible
Mozilla Web browsers are potentially more vulnerable to attack than Microsoft's Internet Explorer, according to a Symantec report. But the report, released Monday, also found that hackers are still focusing their efforts on IE.
The open-source Mozilla Foundation browsers, such as the popular Firefox, have typically been seen as more secure than IE, which has suffered many security problems in the past. Mitchell Baker, president of the foundation, said earlier this year that its browsers were fundamentally more secure than IE. She also predicted that Mozilla Foundation browsers would not face as many problems as IE, even as their market share grows.
Symantec's Internet Security Threat Report Volume VIII contains data for the first six months of this year that may contradict this perception.
According to the report, 25 vendor-confirmed vulnerabilities were disclosed for the Mozilla browsers during the first half of 2005, "the most of any browser studied," the report's authors stated. Eighteen of these flaws were classified as high severity.
"During the same period, 13 vendor-confirmed vulnerabilities were disclosed for IE, eight of which were high severity," the report noted.
The average severity rating of the vulnerabilities associated with both IE and Mozilla browsers in this period was classified as "high", which Symantec defined as "resulting in a compromise of the entire system if exploited."
The Mozilla Foundation did not immediately respond to requests for comment.
Symantec reported that the gap between vulnerabilities being reported and exploit code being released has dropped to six days on average. However, it's not clear from the report how quickly Microsoft and Mozilla released patches for their respective vulnerabilities, or how many of the vulnerabilities were targeted by hackers, though Microsoft generally releases patches only on a monthly basis.
Symantec admitted that "at the time of writing, no widespread exploitation of any browser except Microsoft Internet Explorer has occurred," but added that it "expects this to change as alternative browsers become increasingly widely deployed."
There is one caveat: Symantec counts only those security flaws that have been confirmed by the vendor. According to security monitoring company Secunia, there are 19 security issues that Microsoft still has to deal with for Internet Explorer, while there are only three for Firefox.
The report also highlighted a trend away from the focus of security being on "servers, firewalls, and other systems with external exposure." Instead, "client-side systems--primarily end-user systems--(are) becoming increasingly prominent targets of malicious activity."
Web browser vulnerabilities are becoming a preferred entry point into systems, the report stated. It also highlighted the trend of hackers operating for financial gain rather than recognition, increased potential exposure of confidential information, and a "dramatic increase in malicious code variants".
Tom Espiner of ZDNet UK reported from London. CNET News.com's Joris Evers contributed to this report.
Not for commercial use. For educational and discussion purposes only.
Hey, Symantec makes its money selling malware protection. MS is their bread and butter.
Take down a hand full of DNS servers running BSD and you can bring down the entire internet!
Tell that to the punk who just got the book thrown at him..
See post #71
And Communism.orgs windows ASP technology allows them to make polls saying how bad America is..
wow, what a load of crap.
the firefox is a relatively young browser, and the flaws are relatively minor. And when they're announced, they're fixed with incredible speed.
With MS, you tend do get "wow, that's really bad" kind of bugs (ActiveX- the worst idea ever?) - and they're usually denied first, put off second, and have a patch released 'eventually'.
Mozilla doesn't offer any database software.
It's called Demzilla because it's a large list, not because of its non-existent Mozilla software.
the marketing and technology agency behind the DNC's database technology, the group also places bids with Google and Yahoo!'s Overture on issue-oriented search keywords such as "minimum wage," "economy," and "education."
Yeah, Google and Yahoo are going to be really biased when it comes to reporting aren't they?
Thanks for the link GE, I may be thinking twice before I use these 2 search engines in the future.
And what do the demmies use? I consider them more of a threat to the US than commies, nazis and muzzies. But again, I don't put too much significance on what OS a political party uses. I do have a problem with them making certain free Operating Systems mandatory for all government owned sites. Although, in all fairness, that is not the fault of the OSS.
I concur. The government should not be required to use a specific open source solution.
However, considering that it's our tax dollar that they're spending, all government documents should be available in a completely open, fully documented format.
That mean no MS SQL Server for government storage, no Word documents, and no Active Server Pages.
thanks
It's called Demzilla, as my link indicated in honor of open source software, which the DNC and Howard Dean clearly support. Howard Dean referred to his own campaign as "open source politics", any atttempts to deny the relationship are futile.
Sure it is, when the primary developers of GNU software and license owners of GPL software say it's their goal to make all proprietary software obsolete. If you're a paid sofware developer, ignore at your own risk.
Sick picture. I expect about as much from you losers.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.