December 21st, 2009 by ahoogWell, it’s nice to see Adobe at the top of the list given all the 0-day exploits. Bit9 seems to do great work but the white paper is behind a registration firewall (they should just release it, trust me, it’s better that way). Here’s the results from the press release:
This year Adobe applications top the list with four applications identified in the U.S. National Institute of Standards and Technology's (NIST) official vulnerability database:
- Adobe Acrobat
- Flash Player
- Reader
- Shockwave
had vulnerabilities that were rated “High” including ones that allowed remote attackers to execute arbitrary code, trigger memory corruption, denial of services or application crashing.
Other vulnerable applications on the list include:
* Apple Quicktime
* Mozilla Firefox
* Opera
* RealPlayer
* Sun Java
* Trillian
The applications on the list meet the following criteria:
* Runs on Microsoft Windows
* Is well-known in the consumer space and frequently downloaded by individuals
* Is not classified as malicious by enterprise IT organizations or security vendors
* Contains at least one critical vulnerability that was:
o First reported in January 2009 or after
o Registered in the U.S. National Institute of Standards and Technology's (NIST) official vulnerability database at http://nvd.nist.gov, and given a severity rating of high (between 7.0-10.0) on the Common Vulnerability Scoring System (CVSS)
o Relies on the end user, rather than a central IT administrator, to manually patch or upgrade the software to eliminate the vulnerability, if such a patch exists
o The application cannot be automatically and centrally updated via Enterprise tools such as Microsoft SMS & WSUS.
via Bit9 Releases Annual Report on Top Vulnerable Applications in 2009.
