2005 US-CERT Secuirty Year end Index (all of the problems with oses)

[Swimmer]

This is a list of all of the recoreded os flaws in all of the major operating systems for the year 2005.

http://www.us-cert.gov/cas/bulletins/SB2005.html

check it out.. Kinda of intersting..

US-CERT: 5,198 Software Flaws in 2005

Security researchers uncovered a record 5,198 vulnerabilities in software products this year, nearly 38 percent more than the number of flaws found in 2004, according to statistics published by US-CERT, a cyber security information-sharing collaboration between the Department of Homeland Security and the CERT Coordination Center at Carnegie Mellon University in Pittsburgh.

According to US-CERT, researchers found 812 flaws in the Windows operating system, 2,328 problems in various versions of the Unix/Linux operating systems (Mac included). An additional 2,058 flaws affected multiple operating systems. There may well have been more than 5,198 flaws discovered this year; these were only the ones reported to US-CERT.

I know Microsoft issued a lot of patches this year that fixed quite a few vulnerabilities ... but 812? My suspicion has always been that Microsoft sometimes fixes multiple flaws with a single patch, even though its advisories may make it appear as though the patch addressed a singular issue.

I'd love to know just what percentage of those reported Windows flaws have been fixed. For that matter, it would be lovely to know that for all of the flaws reported last year.

Take a second to scroll down the incredibly long list of software flaws. It may well be that this is a factor of there being more software out there, hence more lines of code and a greater number of vulnerabilities.

But that answer seems a bit too simplistic: my take on this is that as Microsoft takes steps to make their OS more secure (and yes, Service Pack 2 for XP does make it a lot harder for malware to exploit vulnerabilities on the system -- this latest WMF exploit notwithstanding), so attackers are looking at developing more exploits for applications that run on top of Windows and interact directly with the user (and are freely allowed in and out of software firewall applications).

The other thing at work here is that security has become a big business with big profits to those who can show they are able to protect users from previously unknown security holes. The competition among companies that sell protection products in this space is quite fierce, and researchers from each of those entities spend quite a lot of time digging up vulnerabilities in widely used software products, with a particular interest in security applications, it seems.

I'm sure there are other factors at work here as well. Your thoughts?

Have a very happy and prosperous New Year, Security Fix readers, and thank you for helping to build such a great community.