Vulnerabilities / Threats
2/23/2011
11:02 AM
50%
50%

80% Of Browsers Have Known Vulnerabilities

Most problems are caused by insecure plug-ins, such as Java, Adobe Reader, QuickTime, and Flash, finds Qualys.

Clicking Through Opera 11 Browser Beta
(click image for larger view)
Slideshow: Clicking Through Opera 11 Browser Beta

Roughly 80% of browsers today are insecure, owing to their having a known vulnerability either in the browser itself, or due to a vulnerable plug-in, such as an outdated version of Shockwave, Flash, the Java runtime environment, or QuickTime.

That finding comes from research conducted by vulnerability management and security policy compliance vendor Qualys. The results are based on the 200,000 people who, over the past 6 months, used the company's free BrowserCheck tool, which looks for known vulnerabilities in Internet Explorer, Firefox, Chrome, Safari, and Opera browsers, running on Windows, Mac OS X, or Linux machines. About 10% of people who used the tool appeared to be doing so from a corporate network.

Interestingly, more than half of browser vulnerabilities stem from plug-ins. "The number was very high for the plug-ins, higher than I had expected," said Wolfgang Kandek, CTO of Qualys, in an email interview.

The most common insecure browser plug-ins in use are (in order): Java, Adobe Reader, QuickTime, Flash, Shockwave, and Windows Media Player. Many of these plug-ins are widespread -- 97% of computers have the Adobe Flash plug-in installed, and 95% have one for Windows Media Player.

Meanwhile, only about 20% of browsers are insecure due to the native browser application (not counting plug-ins). Kandek said that's testament to browser makers' structured approach to updates, which includes alerting users or simply updating browsers automatically when a new version becomes available.

Unfortunately, few plug-ins auto-update. Accordingly, it's up to IT departments to secure them. "Focus attention on the plug-ins of the browsers, determine if plug-ins are actually necessary, [and] look for plug-ins that have an update program," said Kandek.

One piece of good news from the study is that while 80% of consumers today are using insecure browsers, that's down from a high of nearly 90% in June 2010. What accounts for the improvement? "A number of factors play a role for the small decline, but we have seen good acceptance of the new Adobe Reader X, which has reduced the exposure for PDF users in general," said Kandek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Companies Blindly Believe They've Locked Down Users' Mobile Use
Dawn Kawamoto, Associate Editor, Dark Reading,  11/14/2017
Microsoft Word Vuln Went Unnoticed for 17 Years: Report
Kelly Sheridan, Associate Editor, Dark Reading,  11/14/2017
121 Pieces of Malware Flagged on NSA Employee's Home Computer
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/16/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Managing Cyber-Risk
An online breach could have a huge impact on your organization. Here are some strategies for measuring and managing that risk.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.