Microsoft patched fewer security flaws on its Windows Vista operating system than any other recently released desktop operating systems, the company boasted in a new study.
"Windows Vista has an improved security vulnerability profile over its predecessor and a significantly better profile to comparable modern competitive operating systems," stated Jeff Jones, director of the Trustworthy Computing initiative at Microsoft's Security Business Unit.
The Windows Vista 6-month Vulnerability Report (PDF) compared the number of flaws during the 90 days after the application's launch for Windows Vista, Windows XP, Red Hat Enterprise Linux 4 (RHEL4) Workstation, Ubuntu 6.06 LTS, SuSE Linux Enterprise Desktop 10 (SLED10) and Apple Mac OS X. (Also see table on page two)
Vista beat the other operating systems on nearly all fronts, according to the report, logging the fewest fixed vulnerabilities and the fewest repairs with a severity rating of 'high'.
Microsoft's operating system ranked second in the number of unpatched flaws after 90 days, trailing behind only Windows XP.
Apple's OS X ranked third behind the two Windows versions, followed by Ubuntu, SLED10 and RHEL4.
Comparing the number of patched and disclosed vulnerabilities is a controversial method of comparing the security between products. Different operating systems have different features, offering attackers diverse ways to hit the software.
Jones attempted to pre-empt criticism over features by including a tweaked version of the three Linux distributions in his test.
The adapted version had been stripped of bundled applications that are not found in Windows or OS X, such as the OpenOffice productivity suite, as well as graphics and developer tools.
The number of fixes also failed to consider the popularity with attackers and security researchers. Because Windows is the predominant operating system, users run a greater risk of getting hit.
But this has also caused the software to be closely scrutinised by Microsoft and independent security researchers as they attempt to protect their clients.
Researchers, meanwhile, have started to closely track Apple software. This has been sparked by frustration over the firm's arrogant attitude towards outside researchers as well as the refusal by so-called Mac fan boys to acknowledge that Apple software is not bullet-proof.
This has prompted the disclosure of a
slew of security flaws in the days after the firm launched its
Safari 3 beta for Windows.
Jones's report is bound to receive criticism for his security claims, but he seemed well aware of that risk. In closing the 14-page study, he wrote:
"Jeff actively encourages readers to challenge his assumptions, analysis and conclusions and provide critical feedback – but asks for equal (or better) rigour in methodology and analysis to support the challenges, as opposed to enthusiastic espousal of unsupported evangelistic fervour."
Vulnerabilities in the first 90 days after launch:
| flaws pre-launch1
(high severity)*
| flaws fixed in first 90 days
(high severity)*
| unpatched after 90 days
(high severity)*
|
Windows Vista
| 0 | 12 (10)
| 15 (1)
|
Windows XP
| 3 (0)
| 36 (23)
| 3 (2)
|
REL4ws
| 129 (40)
| 281 (86)
| 65 (12)
|
REL4ws reduced**
| n/a
| 214 (62)
| 59 (12)
|
Ubuntu 6.06 LTS
| 29 (9)
| 145 (47)
| 20 (n/a)
|
Ubuntu 6.06 reduced**
| n/a
| 74 (28)
| 11 (2)
|
SLED10
| 23 (5)
| 159 (50)
| 27 (6)
|
SLED10 reduced**
| n/a
| 123 (44)
| 20 (6)
|
OS X 10.4
| 10 (3)
| 60 (18)
| 16 (3)
|
1: vulnerabilities that were disclosed prior to the software release. In most cases a patch was available, but had to be applied by the user after installation
* high severity rating assigned by the
National Vulnerabilitiy Database of the National Institute of Standards and Technology
** Distribution tweaked to mimick the functionality of Windows by stripping bundled components such as OpenOffice and development tools
source:
Tom Sanders in California for
www.vnunet.com
