Firefox tops list of 12 most vulnerable apps

Mozilla's flagship Firefox browser has earned the dubious title of the most vulnerable software program running on the Windows platform.

According to application whitelisting vendor Bit9, Firefox topped the list of 12 widely deployed desktop applications that suffered through critical security vulnerabilities in 2008.  These flaws exposed millions of Windows users to remote code execution attacks.

The other applications on the list are all well-known and range from browsers to media players, to VOIP chat and anti-virus software programs.  Here's Bit9's dirty dozen:

1. Mozilla Firefox:  In 2008, Mozilla patched 10 vulnerabilities that could be used by remote attackers to execute arbitrary code via buffer overflow, malformed URI links, documents, JavaScript and third party tools.
2. Adobe Flash and Adobe Acrobat:  Bit9 listed 14 flaws patched this year that exposed desktops of arbitrary remote code execution via buffer overflow,“input validation issues” and malformed parameters.
3. EMC VMware Player,Workstation and other products:  A total of 10 bugs introduced risks ranging from privilege escalation via directory traversal, ActiveX buffer overflows leading to arbitrary code execution and denial of service.
4. Sun Java JDK and JRE, Sun Java Runtime Environment (JRE): Inability to prevent execution of applets on older JRE  release could allow remote attackers to exploit vulnerabilities of these older releases. Buffer overflows allowing creation, deletion and execution of arbitrary files via untrusted applications.  10 patched vulnerabilities listed.
5. Apple QuickTime, Safari and iTunes:  In QuickTime, the list includes nine vulnerabilities that allow remote attackers to execute arbitrary code via buffer overflow, or cause a denial of service (heap corruption and application crash) involving malformed media files, media links and third party codecs.  The Safari for Windows browser was haunted by three flaws that could be lead to arbitrary code execution and  denial of service involving JavaScript arrays that trigger memory corruption.  Apple's iTunes software was susceptible to a remote improper update verification that allowed man-in-the-middle attacks to execute arbitrary code via a Trojan horse update.
6. Symantec Norton products (all flavors 2006 to 2008): Stack-based buffer overflow in the AutoFix Support Tool ActiveX exposed Windows users to arbitrary code execution.
7. Trend Micro OfficeScan: A total of four stack-based buffer overflows that opened doors for  remote attackers to execute arbitrary code.
8. Citrix Products: Privilege escalation in DNE via specially crafted interface requests affects Cisco VPN Client, Blue Coat WinProxy, SafeNet SoftRemote and HighAssurance Remote. Search path vulnerability, and buffer overflow lead to arbitrary code execution.
9. Aurigma Image Uploader, Lycos FileUploader:  Remote attackers can perform remote code execution via long extended image information.
10. Skype:  Improper check of dangerous extensions allows user-assisted remote attackers to bypass warning dialogs.Cross-zone scripting vulnerability allows remote attackers to inject script via Internet Explorer web control.
11. Yahoo Assistant: Remote attackers can execute arbitrary code via memory corruption.
12. Microsoft Windows Live (MSN) Messenger: Remote attackers are allowed to control the Messenger application, "change state," obtain contact information and establish audio or video connections without notification.

See Bit9's full report (.pdf) for information on how the list was put together, including criteria for inclusion.

* Image source: Channy Yun's Flickr photostream (Creative Commons 2.0)