Most vulnerable apps on Windows

Well this list is going to get some heckles up that's for sure -Ryan Naraine from ZDNet discusses the "most vulnerable Windows-based applications in 2007, according to endpoint security vendor Bit9".

Here’s the top-ten from Bit9:

1. Yahoo! Messenger 8.1.0.239 and earlier
2. Apple QuickTime 7.2
3. Mozilla Firefox 2.0.0.6
4. Microsoft Windows Live (MSN) Messenger 7.0, 8.0
5. EMC VMware Player (and other products) 2.0, 1.0.4
6. Apple iTunes 7.3.2
7. Intuit QuickBooks Online Edition 9 and earlier
8. Sun Java Runtime 1.6.0_X
9. Yahoo! Widgets 4.0.5 and previous
10. Ask.com Toolbar 4.0.2.53 and previous

I guess the list specific version numbers is one reason for some programs appearing there though I have to admit like Ryan, I was surprised not to see IE6 on there. Not that it's especially bad, just that it's so widely used. The Bit9 explanation?

The reason most Microsoft software doesn’t make the list is because by now most companies have a pretty good process in place for identifying, patching, and fixing vulnerable Microsoft software. The same cannot be said for apps like Firefox, iTunes, and other packages.

Are we making progress with trustworthy computing? I'd say so...

Comments

• Anonymous
  November 05, 2007
  What I read is not that trustworth computing is a succes, but that the failures of trustworthy computing have forced the rest of the IT infrastructure to come up with workarounds and fixes. It's not that MS products are safe, it's that everyone knows to wear hazmat suits while working with them.

• Anonymous
  November 05, 2007
  Eadwacer, that's a fairly common response I hear but I rarely see facts and figures to back that up. Do you have them?

• Anonymous
  November 05, 2007
  The comment has been removed

• Anonymous
  November 05, 2007
  I am drawing a conclusion based on the text of the original article - in fact, on the part you quoted.  "by now most companies have a pretty good process in place for identifying, patching, and fixing vulnerable Microsoft software" Not "by now MS has improved their software so that it's not as vulnerable as the ones listed." So according to the article, it's not MS that's doing a better job, it's the companies, improving their ability to minimize the impact.  Note that this conclusion would hold no matter what two or three letters you replaced "MS" with.  I guess my main position on the original article is that it's an example of your results depending on how you measure things and what you measure. Measuring anything meaningful in this area is hard, and their protocol isn't one I'd agree with.

• Anonymous
  November 06, 2007
  The comment has been removed