Third-party software bugs skyrocket in 2010

Lack of auto-patching tools leaves Windows users vulnerable to attack, says Secunia

A surge in third-party software vulnerabilities accounted for the bulk of a ballooning bug count in the first half of 2010, said Danish security firm Secunia today.

The increasing number of flaws uncovered in non-Microsoft software puts users at risk because few third-party vendors offer automated update services, requiring people to seek out updates, then manually download and install patches.

"We were astonished to see the extent of the vulnerabilities in third-party software," said Stefan Frei, research analyst director at Copenhagen-based Secunia. "The jump in vulnerabilities was almost exclusively due to third-party applications, not Microsoft's."

Frei analyzed Secunia's vulnerability database -- the company is best known for tracking bugs and issuing advisories -- and collected information on the average Windows PC's application inventory using Secunia's PSI (Personal Software Inspector). PSI is a free tool that scans PCs to produce a list of vulnerable software.

Secunia came up with a list of the top 50 programs in the average PC's software portfolio, tallied the vulnerabilities in those applications that were revealed in the first half of 2010, used those numbers to estimate the year's total, and then compared them with bug counts going back to 2005.

The results were striking. "This analysis clearly identifies vulnerabilities from third-party programs to be almost exclusively responsible for the increasing [vulnerability count] trend observed since 2007," Frei said in a report he published today ( download PDF ). "Data from the first half of 2010 shows that third-party program vulnerabilities are the primary risk factor for typical end-user PCs."

While vulnerabilities in Windows XP and Vista will climb by 31% and 34%, respectively, this year compared to 2009, bugs in third-party software will jump by 92%, in other words, nearly double last year's number.

Of the total increase in vulnerabilities that a Windows XP user will likely face throughout all of 2010, 79% can be traced to third-party programs, not Windows or other Microsoft software, such as Internet Explorer or Office.

Secunia's conclusion mirrors that of other security firms this year. Antivirus vendors McAfee and Symantec have both reported large surges in attacks exploiting bugs in Adobe's Reader, for example, one of the most widely-installed third-party browser plug-ins. McAfee, for example, said that exploits of Reader jumped 65% in the first quarter of 2010 compared to all of 2009.

The rising tide of vulnerabilities in third-party programs leaves users confused or worse, said Frei. "From the end-user's perspective, it adds lots of additional complexity, and makes the management of a PC that much harder," he said.

Most software makers don't make an effort to keep users safe, Frei argued, pointing out the dearth of automatic updating mechanisms like Microsoft's Windows Update. There are some exceptions -- Google , Mozilla and Adobe, which recently offered hands-off patching -- but for the most part, users have to scramble themselves to dig up and download fixes.

Which leaves most Windows machines vulnerable to attack.

"The best ways to reduce the risk...would be reducing the number of vulnerabilities and the window of opportunity to exploit vulnerabilities," said Frei in his report. "Sadly, data from more than a decade shows that the industry has proved unable to reduce the number of vulnerabilities discovered in their products, and there is little hope that this will change substantially in the years ahead."

With bug counts unlikely to shrink, users need a way to "readily install patches and thereby reduce the window of opportunity for criminals," Frei continued.

Along those lines, Secunia is working on an update to PSI, dubbed PSI 2.0, that will automatically fetch security patches from some 3,000 software vendors. PSI 2.0 was released as a "technical preview" last month, and will ship in final form before the end of the year, said Frei.

"It will automate the download and installation of the different third-party installation programs," Frei said. "It will either do it all automatically, or if the user wants, in a manual mode that says, 'Okay, here's the update, do you want it?'"

PSI 2.0's preview can be downloaded from Secunia's site .

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags securityMicrosoftoperating systemssoftwareWindowssecunia

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld (US)
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?