[ISN] Re: [Full-disclosure] OSS means slower patches

[InfoSec News]

Forwarded from: security curmudgeon <jericho at attrition.org>
To: full-disclosure at lists.grok.org.uk
Cc: editorial at australianIT.com.au
Date: Mon, 19 Sep 2005 09:53:40 -0400 (EDT)
Subject: Re: [Full-disclosure] OSS means slower patches

: 
http://australianit.news.com.au/articles/0,7204,16650762%5E15306%5E%5Enbv%5E,00.html

The obvious criticism:

"The Mozilla family of browsers had the highest number of vulnerabilities
during the first six months of 2005, with 25," the Symantec report says.
"Eighteen of these, or 72 per cent, were rated as high severity. Microsoft
Internet Explorer had 13 vendor confirmed vulnerabilities, of which eight,
or 62 per cent, were considered high severity."

Microsoft IE had at least 19 vulnerabilities from 2005-01-01 to
2005-06-30. Why does Symantec make the distinction of "X vulnerabilities
in Mozilla" vs "MSIE had X *vendor confirmed vulnerabilities*"? This all
to conveniently allows the silently patched vulnerabilities to slip
through the cracks of our statistics. Does Mozilla's honesty in
acknowledging vulnerabilities come back to bite them in the ass?

Mozilla browsers had more than 25, but are 72 per cent really "high
severity"? Download information spoofing x2, File extension spoofing, URL
restriction bypass, DoS x2, redirect spoofing, XSS, link status bar
spoofing, Dialog overlapping, URL Wrap Obfuscation.. are all of these
really "high severity"? Is that theoretical, practical, or hype?

Now, the media/symantec driven propoganda (for lack of better word?):

   THE growing popularity of open-source browsers and software may be
   responsible for the increasing gap between the exposure of a
   vulnerability and the provision of patch to fix it, security software
   vendor Symantec has said.

   Mr Sykes said the increasing popularity of open source software, such as
   the Mozilla Foundation's Firefox browser, could be part of the reason
   for the increase in the gap between vulnerability and patch, with the
   open source development model itself part of the problem. "It is
   relying on the goodwill and best efforts of many people, and that
   doesn't have the same commercial imperative," he said. "I'm sure that is
   part of what is causing the blow-out in the patch window."

   The growth in Firefox vulnerability reports coincides with its
   increasing popularity with users. "It is very clear that Firefox is
   gaining acceptance and I would therefore expect to see it targeted," Mr
   Sykes said. "People don't attack browsers and systems per se, they
   attack the people that use them," he said. "As soon as large banks
   started using Linux, Linux vulnerabilities started to get exploited."

The premise of this article is open source software is to blame for longer
vendor response times. In laymen's terms, blame vendors like Mozilla for
having vulnerabilities patched slower? Err, compared to what? This shallow
article doesn't even qualify that statement! Slower than previous
vulnerabilities? Slower than non open source? Given the article directly
compares Mozilla browsers to Microsoft IE, it is trivial to assume the
claim is made in relation to closed source vendors such as Microsoft. So
then what .. 30 days "blown out" to 54 days is some huge time gap compared
to Microsoft IE patches? What clueless *moron* really believes this crap
they are shovelling? Is it Symantec or Chris Jenkins or Australian IT?

Given that Symantec won't even quote previous statistics: "Symantec had
not published previously statistics on the average time required to
produce patches, but Mr Sykes said data showed the lag had previously been
about 30 days." Given that Jenkins/AusIT/Symantec won't give us any
statistics (even questionable ones) regarding MSIE patches, we're supposed
to take this at face value? It is *well documented* that Microsoft takes
well over 30 days to patch vulnerabilities. It is also becoming crystal
clear that Microsoft is hiding behind their "30 day patch cycle" to imply
that is the longest they go before patching a vulnerability, when it
simply is not the case. Taking a look at a *single vendor* [1] and their
experience with reporting vulnerabilities to Microsoft, we see that they
give MS a 60 day window to patch vulnerabilities, and are consistantly
overdue. As of this mail, the worse is *ONLY* 114 days past due (we've
seen it closer to 250 days before). So again, where are these implications
coming from? Where does this statement/conclusion/observation that "OSS
causes slower patches" come from exactly?


[1] http://www.eeye.com/html/research/upcoming/index.html
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/