Internet browsers are perhaps one of the most exploited applications because of all they are capable are doing with the internet. For 2012, Mozilla’s Thunderbird, SeaMonkey, and Firefox had the following security advisory bulletins:
| 2012 | |
| Bulletins | 106 |
| Vulnerabilities | 152 |
| Bulletins with Privilege Exploitations | 53 |
| Vulnerabilities with Privilege Exploitations | 93 |
| % of Bulletins with Privilege Exploitation | 50.0% |
| % of Vulnerabilities with Privilege Exploitation | 61.2% |
While not the case in 2011, for 2012 all of Mozilla’s Security Advisories applied to Firefox. So this means that there were 93 out of 152, or 61.2%, of total vulnerabilities that had privilege exploitations. As we learned from the Introduction on Privilege Exploitation, privilege exploitations are the most dangerous type of vulnerability because they allow for changes to computer configuration using the rights of the logged in user.
This past year Mozilla has steadily rolled out updates every 2-4 weeks for Firefox. This means that if a user does not update to the latest version they could be left vulnerable to 3 or 4 vulnerabilities with privilege exploitations on average. Most businesses understand the risk of not updating to the latest version, so they make sure to constantly update their software.
As we saw with the Zero Day Vulnerability Protection with Privilege Management blog, zero-day threats are not mitigated by updating to the latest version of software, because the latest version does not exist. However using application privilege management does mitigate zero-day vulnerabilities because it removes rights and privileges from the application. Using application privilege management is even more secure than a standard user.
So that leaves the question – with 93 vulnerabilities with privilege exploitation and the potential for zero-day threats, will you leave your environment exploitable? Or will you use Arellia Application Control Solution toremove application rights from Mozilla Firefox and Arellia Local Security Solution to manage user privileges? The answer is clear; protect your environment today by using Arellia as a privilege manager for applications and users.
About Arellia: Arellia provides solutions for privilege management, application whitelisting, securing local administrator accounts, and compliance remediation. Arellia products are integrated with the Symantec Management Platform and sold through Symantec.