Vulnerability disclosure hits record levels

More vulnerability disclosures were made in the first half of 2010 than ever before for such a period, according to IBM research.

Security

Vulnerability disclosures reached record levels in the first half of 2010, with most security holes lacking vendor patches, a report has shown.

In total, IBM's X-Force Research and Development team recorded 4,396 new vulnerabilities over the first six months of 2010, representing a 36 per cent rise over the same period in 2009.

More than half of these flaws did not have a vendor-supplied patch by the end of the period.

The spike in disclosures might be the product of some of the work happening at software companies, which are hopefully putting more effort into trying to identify threats, patch them and then inform the public, said Tom Cross, manager of the X-Force team.

"It might actually be a good sign that we've seen an increase in vulnerability disclosure but for us it certainly makes the days longer," Cross said.

Steve Robinson, general manager of IBM Security Solutions, added: "This year's X-Force report reveals that although threats are on the rise, the industry as a whole is getting much more vigilant about reporting vulnerabilities."

Vendor differences

The X-Force team reviewed the vendors with the most disclosures and discovered Sun Microsystems had the worst patch rate for the first half of 2010, with 24 per cent of vulnerabilities unpatched by the end of that period.

Microsoft did not fare much better, with 23.2 per cent of security holes lacking a fix.

Adobe, which plugged security holes in its Reader and Acrobat software this month, only had 2.9 per cent of bugs unpatched.

Google had the worst rate when it came to vulnerabilities with critical and high ratings, with 33 per cent patchless by the end of the period. Apple was the best performer in this category with none left unpatched.

Of all disclosures of vulnerabilities in operating systems ranked critical and high, Microsoft reported more than any other major vendor.

Almost three-quarters of all such disclosures came from Microsoft, with Linux far behind in second on 16 per cent.

Featured Resources

How virtual desktop infrastructure enables digital transformation

Challenges and benefits of VDI

Free download

The Okta digital trust index

Exploring the human edge of trust

Free download

Optimising workload placement in your hybrid cloud

Deliver increased IT agility with the cloud

Free Download

Modernise endpoint protection and leave your legacy challenges behind

The risk of keeping your legacy endpoint security tools

Download now

Recommended

Safari bug lets websites track browsing activity and unique identifiers
web browser

Safari bug lets websites track browsing activity and unique identifiers

18 Jan 2022
El Salvador becomes latest target of Pegasus spyware
spyware

El Salvador becomes latest target of Pegasus spyware

13 Jan 2022
Mac shipments grew at twice the pace of PCs in 2021
Hardware

Mac shipments grew at twice the pace of PCs in 2021

13 Jan 2022
IBM ramps up sustainability efforts with Envizi acquisition
Business strategy

IBM ramps up sustainability efforts with Envizi acquisition

12 Jan 2022

Most Popular

How to move Microsoft's Windows 11 from a hard drive to an SSD
Microsoft Windows

How to move Microsoft's Windows 11 from a hard drive to an SSD

4 Jan 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

6 Jan 2022
Microsoft Exchange servers break thanks to 'Y2K22' bug
email delivery

Microsoft Exchange servers break thanks to 'Y2K22' bug

4 Jan 2022