Abstract
We study the interplay in the evolution of Firefox source code and known vulnerabilities in Firefox over six major versions (v1.0, v1.5, v2.0, v3.0, v3.5, and v3.6) spanning almost ten years of development, and integrating a numbers of sources (NVD, CVE, MFSA, Firefox CVS). We conclude that a large fraction of vulnerabilities apply to code that is no longer maintained in older versions. We call these after-life vulnerabilities. This complements the Milk-or-Wine study of Ozment and Schechter—which we also partly confirm—as we look at vulnerabilities in the reference frame of the source code, revealing a vulnerabilitiy’s future, while they looked at its past history. Through an analysis of that code’s market share, we also conclude that vulnerable code is still very much in use both in terms of instances and as global codebase: CVS evidence suggests that Firefox evolves relatively slowly.
This is empirical evidence that the software-evolution-as-security solution—patching software and automatic updates—might not work, and that vulnerabilities will have to be mitigated by other means.
This work is supported by the European Commission under projects EU-FET-IP-SECURECHANGE and EU-FP7-IST-IP-MASTER.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Howard, M., Lipner, S.: The Security Development Lifecycle. In: Secure Software Development. Microsoft Press, Redmond (May 2006)
McGraw, G., Chess, B., Migues, S.: Building Security In Maturity Model v 1.5 (Europe Edition). Fortify, Inc., and Cigital, Inc. (2009)
Ozment, A., Schechter, S.E.: Milk or wine: Does software security improve with age? In: Proceedings of the 15th Usenix Security Symposium. USENIX Association, Berkeley (August 2006)
Hethcote, H.W.: The mathematics of infectious diseases. SIAM Review 42(4), 599–653 (2000)
Massacci, F., Nguyen, V.H.: Which is the right source for vulnerabilities studies? an empirical analysis on mozilla firefox. In: Proc. of MetriSec 2010 (2010)
Bird, C., Bachmann, A., Aune, E., Duffy, J., Bernstein, A., Filkov, V., Devanbu, P.: Fair and balanced?: bias in bug-fix datasets. In: Proceedings of the 7th Joint Meeting of the European Software Engineering Conference and the ACM SIGSOFT Symposium on the Foundations of Software Engineering, pp. 121–130. Association for Computing Machinery. ACM Press, New York (2009)
Bozorgi, M., Saul, L.K., Savage, S., Voelker, G.M.: Beyond heuristics: Learning to classify vulnerabilities and predict exploits (July 2010)
Ozment, A.: The likelihood of vulnerability rediscovery and the social utility of vulnerability hunting. In: Proceedings of 2nd Annual Workshop on Economics and Information Security, WEIS 2005 (2005)
Ozment, A., Schechter, S.E.: Milk or wine: Does software security improve with age? In: Proceedings of the 15th Usenix Security Symposium, USENIX 2006 (2006)
Rescorla, E.: Is finding security holes a good idea? IEEE Security and Privacy 3(1), 14–19 (2005)
Alhazmi, O., Malaiya, Y., Ray, I.: Measuring, analyzing and predicting security vulnerabilities in software systems. Computers & Security 26(3), 219–228 (2007)
Alhazmi, O., Malaiya, Y.: Modeling the vulnerability discovery process. In: Proceedings of the 16th IEEE International Symposium on Software Reliability Engineering, pp. 129–138 (2005)
Alhazmi, O., Malaiya, Y.: Application of vulnerability discovery models to major operating systems. IEEE Trans. on Reliab. 57(1), 14–22 (2008)
Anderson, R.: Security in open versus closed systems - the dance of Boltzmann, Coase and Moore. In: Proceedings of Open Source Software: Economics, Law and Policy (2002)
Chowdhury, I., Zulkernine, M.: Using complexity, coupling, and cohesion metrics as early predictors of vul. Journal of Software Architecture (2010)
Gegick, M., Rotella, P., Williams, L.A.: Predicting attack-prone components. In: Proc. of the 2nd Internat. Conf. on Software Testing Verification and Validation (ICST 2009), pp. 181–190 (2009)
Jiang, Y., Cuki, B., Menzies, T., Bartlow, N.: Comparing design and code metrics for software quality prediction. In: Proceedings of the 4th International Workshop on Predictor Models in Software Engineering (PROMISE 2008), pp. 11–18. ACM, New York (2008)
Menzies, T., Greenwald, J., Frank, A.: Data mining static code attributes to learn defect predictors. IEEE Transactions on Software Engineering 33(9), 2–13 (2007)
Neuhaus, S., Zimmermann, T., Holler, C., Zeller, A.: Predicting vulnerable software components. In: Proceedings of the 14th ACM Conference on Communications and Computer Security (CCS 2007), pp. 529–540 (October 2007)
Shin, Y., Williams, L.: An empirical model to predict security vulnerabilities using code complexity metrics. In: Proceedings of the 2nd International Symposium on Empirical Software Engineering and Measurement, ESEM 2008 (2008)
Shin, Y., Williams, L.: Is complexity really the enemy of software security? In: Proceedings of the 4th Workshop on Quality of Protection (QoP 2008), pp. 47–50 (2008)
Zimmermann, T., Nagappan, N.: Predicting defects with program dependencies. In: Proceedings of the 3rd International Symposium on Empirical Software Engineering and Measurement, ESEM 2009 (2009)
Zimmermann, T., Premraj, R., Zeller, A.: Predicting defects for eclipse. In: Proceedings of the 3th International Workshop on Predictor Models in Software Engineering (PROMISE 2007). IEEE Computer Society, Los Alamitos (2007)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2011 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Massacci, F., Neuhaus, S., Nguyen, V.H. (2011). After-Life Vulnerabilities: A Study on Firefox Evolution, Its Vulnerabilities, and Fixes. In: Erlingsson, Ú., Wieringa, R., Zannone, N. (eds) Engineering Secure Software and Systems. ESSoS 2011. Lecture Notes in Computer Science, vol 6542. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-19125-1_15
Download citation
DOI: https://doi.org/10.1007/978-3-642-19125-1_15
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-19124-4
Online ISBN: 978-3-642-19125-1
eBook Packages: Computer ScienceComputer Science (R0)