Media Player Malefactors
Cenzic claims media players contribute to many Web app vulnerabilities.
Vulnerabilities in media players account for up to 5 percent of the total Web application vulnerability volume during any given quarter, according to a report released last month.
The growing threat to media players suggests developers need to pay closer attention to the impact of these vulnerabilities, according to security experts. The report -- by Santa Clara, Calif.-based Cenzic Inc.'s Intelligent Analysis Lab -- also found that 7 percent of those vulnerabilities pertained to Web servers and 4 percent to Web browsers, according to Tom Stracener, senior security analyst with Cenzic. Mozilla Firefox had the most vulnerabilities at 41 percent, followed by Opera at 26 percent.
The news is not all bad for Windows users and developers. "Microsoft continues to make progress against its IE security battle," the analysts write, "and as a result, its vulnerabilities are down again in Q2 to 17 percent."
The researchers also found that, overall, SQL-injection attacks, at 34 percent, and Cross-Site Scripting, at 23 percent, continue to dominate the total Web vulnerabilities. The .NET vulnerabilities in the Microsoft security bulletins cited issues with GDI+, Stracener says. Microsoft Windows GDI+ is a class-based API for C and C++ programmers designed to make it possible for applications to use graphics and formatted text on both the video display and the printer.