Important Java 6 & WinXP - 160 unpatched vulnerabilities

snoopy · Feb 17, 2014

Why Java 6 Gives Me the Jitters about Windows XP in 2014: 160 Unpatched Vulnerabilities Combined per Year
Posted on:February 13, 2014
Posted in:Security
Posted by:Christopher Budd (Global Threat Communications)

I said in September 2013 that the security situation around Java 6 had gotten much worse. In our recently released 2013 Annual Threat Roundup one thing we looked into is the current state of attacks against Java vulnerabilities. What we see in that report confirms that as of the end of 2013, the Java 6 security situation has indeed gotten worse. And if we take what we see about attacks against Java 6 and apply it to Windows XP when it goes out of support in April 2014, it paints a grim picture of what we can expect in 2014. Our 2013 Annual Threat Roundup shows that the clouds are gathering for a possible perfect storm when Windows XP goes out of support where Java 6 and Windows XP lead to 160 unpatched vulnerabilities per year combined.

First, what does the 2013 Annual Threat Roundup tell us about the current Java 6 situation? Our analysis showed that in 2013 attacks against Java constituted 91% of all web-based attacks. That’s not surprising given the rash of zero day vulnerabilities affecting all versions of Java throughout 2013. Our analysis also shows that at the end of 2013, 50% of all attacks against Java targeted, two vulnerabilities will never be patched on Java 6: CVE-2013-2465 (30%) and CVE-2013-2463 (20%). These two vulnerabilities are relatively new; they were only publicly known as part of Oracle’s June 2013 quarterly patch release and attacks against them only surfaced in August 2013. The fact that these vulnerabilities skyrocketed to capture 50% of the attack “market” in such short time tells us that attackers recognize the value in targeting vulnerabilities that won’t ever be patched.

There’s good reason for attackers to make this shift. We note in our report that when support for Java 6 ended, 76% of organizations were still running it. It’s doubtful that number has diminished much since then. And the pool of unpatched Java 6 vulnerabilities will only get bigger and bigger since these will never be patched. By the end of Q3 2013, we note there were already 31 unpatched vulnerabilities for Java 6. That encompasses two of Oracle’s patch releases, so we can roughly extrapolate about 60 unpatched vulnerabilities per year for Java 6.

What does this tell us we can expect when Windows XP goes out of support in April? First, Windows XP still accounts for 30% of Windows systems out there at the end of 2013. Like Java 6, Windows will be widely used when support ends and unpatched vulnerabilities start to accumulate. And we can make an educated guess of how many vulnerabilities will be disclosed for supported versions of Windows that affect Windows XP and won’t be patched, similar to what happened with Java 6 and CVE-2013-2465 and CVE-2013-2463.
Click to expand...

Read the full story here: http://blog.trendmicro.com/java-6-g...-unpatched-vulnerabilities-combined-per-year/

Log in or Sign up

Important Java 6 & WinXP - 160 unpatched vulnerabilities

snoopy Registered Members

Share This Page

Log in or Sign up

Important Java 6 & WinXP - 160 unpatched vulnerabilities

snoopy Registered Members

Share This Page

Useful Searches