internet security tHreAt rePOrt GOVernMent 2013

p. 146
Symantec Corporation
Internet Security Threat Report 2013 :: Volume 18
VULNERABILITy TRENDS
Web Browser Plug-in Vulnerabilities
Background
This metric examines the number of vulnerabilities affecting
plug-ins for Web browsers. Browser plug-ins are technologies
that run inside the Web browser and extend its features, such
as allowing additional multimedia content from Web pages
to be rendered. Although this is often run inside the browser,
some vendors have started to use sandbox containers to execute
plug-ins in order to limit the potential harm of vulnerabilities.
Unfortunately, Web browser plug-ins continue to be one of
the most exploited vectors for Web-based attacks and drive-by
downloads silently infecting consumer and enterprise users.
Many browsers now include various plug-ins in their default
installation and provide a framework to ease the installation
of additional plug-ins. Plug-ins now provide much of the
expected or desired functionality of Web browsers and are often
required in order to use many commercial sites. Vulnerabilities
affecting these plug-ins are an increasingly favored vector for
a range of client-side attacks, and the exploits targeting these
vulnerabilities are commonly included in attack kits. Web attack
kits can exploit up to 25 different browser and browser plug-in
vulnerabilities at one time and then have full access to download
any malware to the endpoint system.
Some plug-in technologies include automatic update
mechanisms that aid in keeping software up to date, which may
aid in limiting exposure to certain vulnerabilities. Enterprises
that choose to disable these updating mechanisms, or continue
to use vulnerable versions, will continue to put their enterprises
at considerable risk to silent infection and exploitation. With
the hundreds of millions of drive-by download attacks that
Symantec identified in 2011, Web attacks continue to be a
favorite infection vector for hackers and malware authors to
breach enterprises and consumer systems. To help mitigate
the risk, some browsers have started to check for the version of
installed third-party plug-ins and inform the user if there are
any updates available for install. Enterprises should also check
if every browser plug-in is needed and consider removing or
disabling potentially vulnerable software.
Methodology
Web browser plug-in vulnerabilities comprise a sub-set of
the total number of vulnerabilities cataloged by Symantec
over the reporting period. The vulnerabilities in this section
cover the entire range of possible severity ratings and include
vulnerabilities that are both unconfirmed and confirmed by the
vendor of the affected product. Confirmed vulnerabilities consist
of security issues that the vendor has publicly acknowledged,
by either releasing an advisory or otherwise making a public
statement to concur that the vulnerability exists. Unconfirmed
vulnerabilities are vulnerabilities that are reported by third
parties, usually security researchers, which have not been
publicly confirmed by the vendor. That a vulnerability is
unconfirmed does not mean that the vulnerability report is
not legitimate, only that the vendor has not released a public
statement to confirm the existence of the vulnerability.