RE: Mac versus Windows vulnerability stats for 2007
Larry,
The OS X columns contains 7 duplicates :
CVE-2007-6165 (Nov & Dec)
CVE-2007-0646 (Nov & Apr)
CVE-2006-0300 (Mar & Apr)
CVE-2006-0724 (Mar & Apr)
CVE-2007-0229 (Jan & Mar)
CVE-2007-0236 (Jan & Mar)
CVE-2007-0023 (Jan & Feb)
The following 20 reports in the OSX column have a
CVE that says "reserved" with no mention of the
affected OS or product. How do you know those are
OS X flaws ?
CVE-2007-3876
CVE-2007-4708
CVE-2007-4709
CVE-2007-4710
CVE-2007-5847
CVE-2007-5848
CVE-2007-5849
CVE-2007-5858
CVE-2007-5850
CVE-2007-5851
CVE-2007-5853
CVE-2007-5854
CVE-2007-5855
CVE-2007-5856
CVE-2007-5857
CVE-2007-5859
CVE-2007-5860
CVE-2007-5861
CVE-2007-5863
CVE-2007-5862
There are 16 reports in the OS X column for the Sun
JRE/JDK. However, Sun does not provide a JVM for OS
X. Indeed, the corresponding CVE reports don't list OS
X as an affected OS. Why are those reports in the OS X
column ?
CVE-2006-6731
CVE-2006-6736
CVE-2006-6745
CVE-2007-0243
CVE-2007-2435
CVE-2007-2788
CVE-2007-2789
CVE-2007-3004
CVE-2007-3005
CVE-2007-3503
CVE-2007-3504
CVE-2007-3655
CVE-2007-3698
CVE-2007-3922
CVE-2007-4381
CVE-2007-5232
CVE-2007-3504 is described as Windows-only.
However, it appears in the OS X column. Why ?
CVE-2007-3756, CVE-2007-3758 also affect Safari
on Windows (and iPhone) but apparears only in the OS
X column. Why ?
I am curious to know why you listed the following 7
SquirelMail vulnerabilities in the OS X column. This
product is not bundled with OS X. And since it's pure
PHP code, those are surely present on Windows as
well.
CVE-2005-3128
CVE-2006-2842
CVE-2006-3174
CVE-2006-4019
CVE-2006-6142
CVE-2007-1262
CVE-2007-2589
Same question for the 7 MySQL vulns :
CVE-2006-1516
CVE-2006-1517
CVE-2006-2753
CVE-2006-3081
CVE-2006-3469
CVE-2006-4031
CVE-2006-4226
There are also 8 PHP vulns.
CVE-2007-1001
CVE-2007-1460
CVE-2007-1461
CVE-2007-1484
CVE-2007-1521
CVE-2007-1583
CVE-2007-1711
CVE-2007-1717
The OS X column also contains Ruby on Rails vulns.
And Safari 3 vulns (which Apples lists under OS X AND
Windows but not you). And Adobe Flash player.
It looks like to me that you did not consider the same
type of usage. One one hand, a Windows desktop,
with no third-party software. On the other, a Mac
Server loaded with PHP, SquirelMail, Ruby on Rail and
MySQL.
Obviously, you will find more security holes in the
second case.
Regards
François