Quote:
Interestingly, most of the flaws listed by US-CERT are application bugs rather than security holes in the underlying OS. This is likely due to the more stringent QA testing that operating systems undergo before release. Not all vulnerabilities are created equal, either. Chances are, this remote DoS security flaw caused problems for few, if any users. On the other hand, the entries from the SANS Top 20 Internet Security Vulnerabilities list have the potential to make life miserable for any number of users.
The operative word here is QA, the earlier boxes went out with less testing methods being performed on them.....an ananology is todays media reporting of crime, everybody thinks crime is on the rise, yet the facts will tell you different, it's just that certain types of crime which may not have been covered in the past, is now getting more exposure..thus skewing the data for a complete picture...
Quote:
What does it all mean? For one thing, finding and reporting bugs is big business for security companies. By being the first on the block to trumpet the discovery of an obscure buffer overflow attack that exists only as a proof of concept, these companies hope to gain credibility and create a market for their services. Finding and exploiting bugs is also big business for malware writers. While there are still script kiddies looking to "pwn your b0xen," malware writers are more interested in making money. Zombie armies of compromised PCs can sell for thousands of dollars, which makes the hunt for easily exploited bugs potentially very lucrative.
This is the other aspect of this data being produced, a lot of businesses have agendas to increase their business, so they will try to beef up their discoveries, how many of these so called AV/Antispyware companies include false positives in their reporting, even MS's Antispyware will pick up false positives, so all of this data is subjective, and should be carefully scrutinised before labelling one OS as better then the other......