Stephen Withers
Monday, 23 March 2009 10:04
Opinion and Analysis
Page 5 of 5
Yes, someone else might have discovered it independently and used the information for nefarious purposes, but - as far as we know - they didn't. Unless the vulnerability and a corresponding exploit were being used in anything other than extremely focused attacks, we would almost certainly have heard about it.
And if you think Apple should have found the bug for itself by now, take a look at the
ZDI's list of upcoming advisories.
The oldest dates back to 2006, yet HP still hasn't come up with a fix.
And there are another 16 - all described as being of high severity - that remain unfixed since 2007. Which companies are involved? America Online, Borland, Computer Associates, Hewlett-Packard, IBM, Microsoft, Oracle, Real Networks and Symantec.
In comparison, the oldest Apple bug on the list was logged in October 2008.
And despite the much-vaunted 'quick fix' capability of the open source community, there are high-severity Firefox bugs of a similar vintage.
It could be that these relatively old vulnerabilities have remained unfixed because the vendors disagree with TippingPoint's assessment of their importance.