[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

[report] A look at the time Debian takes to fix a security vulnerability



        As I said yesterday I wanted to prepare an answer to the question "How much
time does it take for Debian to fix a given bug?". I have made some analysis regarding
vulnerabilities detected and posted in bugtraq and those sent as DSAs.  It has taken
some more time than expected since the DSAs do not link directly to either Bugtraq's
database or CVE's (Security Team: please see below). But the answer is: 

"For the last year it has taken Debian an average of 35 days to fix security-related
vulnerabilites. However, over 50% of the vulnerabilities where fixed in a 10-days time
frame, and over 15% of them where fixed the same day the advisory was released!"

So I would like to publicly (sp?) give a warm applause to the Debian Security Team
which is doing an excelent job!  

I adjoint some data:

- a Gnumeric spreadsheet with all the information
- a PNG graphic with this year's distribution of time-to-fix (in days) made by
gnuplot with the previous data 

A note for the Security Team: please add a new tag to the DSA's data: <define-tag bid>
and <define-tag cve> that would make it easier to

a) make this kind of analysis stuff
b) track down information regarding vulnerabilities

Many tools (like Nessus for example) link to Bugtraq so it's easier for users to have a
common reference. For example: Nessus says I have vuln XXX but I have installed the
patch advised in DSA which fixes it so I'm ok. 

I will try to take some time to do the same for other OS and pull out a comparative
(which might or might not make the results seem even best), problem is, however, that
this issues are difficult to automate (will try though) 

	Best regards
	
Javi

PS: Of course I have not investigated which reported vulnerabilities are still open
(are there any?), i.e. no DSA has been sent yet. 
?3Ø<fixbugs.xmlíU÷W?Y×%QDt,HÁ+?""?Bt,Ì ??TBQJ@? =	R$?È(]?2?$@Ô?64%dB¤?*ÒC1HÉ?3ïzÿ?oÍû?ÏzÖ^{ísξç?û¬ûh`7KüýHq???UúÒ¦ÆÅÜCªV%)º#Ü<æ??¦å¯¡·|}Ýs´8~òºÓÑD?ë?q²·ç#³cÞÿñ?qí'>˽¯?u´b¸?
!U{E«z
y??X|÷39fÆ¿À4Ôר£k?K~¢?ù*~7ɳ*_?fZ?EÓ,ñ
.zÓ?gV'3`õf¹]],??.[LÇVE??E.?¯å4¹òú¬Ò©üUFk¥ËÍ?nïμ.®?Õnï$d¾M?7·²ô uy´vq¦eFá{+l!ßïxÄÉlñb?°¡?:q?ɼ$¡ÞV¦ôF?ìæMd@E<+¶I)ÊÏjJwC´]ËÑ<m&8öaÖÏ6²D¿»_?AÛTNé?d´c±UU=k?¶3yzì*|ñ1chþ	«/?%]N??òcÄ?ÜU:½Ý>ay˾¡Ï?6TÍÀÞ¾??2&V®Sîã6mìHÍÏFEóÜO?Öí±ò?Ó`Ízg¸?¢Ã
írV/WÑZãV HûS?ï?F?¬
WÃù??s³?¦1ad´ ??ÓHoB?ëÃ?û¨4PûÖm?d¦\?0ÌÉw¾r	k.«]øþ?¿ú­è?b'Ó|gò8?¿º:¸m´óÀh_áD$?óQëáfo°*ätB{ww?wr&ÜÐHY,`}Zrn]??º.?î!ÑÕíÙ°ál?Z6Íôè];$ª?êd8¿P500á©X#@??§ÐÕHÏÑÑ¥óÜÁ#ùVVÙÓ?¶^ö
Ñ
³üÙð·«?l?NV®"2ó$jðL??º<2³O??˱ÿ<óe¬É<uÒé¨?×g½¼÷¿¡????]H.u+¨ÔµG¨ ã¾¡äõV1d⽩ 02?oDD´Æ5û¢j÷Ï>?á4??öÒóÛ´¡´¢GµPÝômÞ'V×l¡I>­¨ª°?ë?0,?içþƽ1$`O?¿y??GAIÝì?¯ÅTLDX>s®2?@îö¡ÜÄOCua§è&.Ð&6Ó$`è?}#ï?ðykÏ¥þ­
sò¬Õ×F=%hE²(u

«ìsk¡!¡"4
Åÿ<+?îY{=2}¢Ü?MxÍ/?®-çw~ÕÈîC?p?v*ZÕéjøàù`Ñê{ògGñR
þöÎóò°b¿í|¹ÿÚK³;sg??soWyø`>BOF=ô|þù?ë5+|_CEB¦^7^õÞRª´°þèýêÒ×ðY×?Ú0±?:w?Ûç
ú&oo??²J\?'[ÙSo??W)¿&Í
Vhõ«_kÐ4±?|?D?,?òçÇ?b??½μ¤{ºVñ?d3'?¨§)?÷* ïÒªH&ë¨,ûâ?t+}àsxÝâÔ/ðèW?iXNP§öÄl¤?^v¸à
ràH,?Þ?Q{FT?G)ÑÃ{´Z??òèb½	?,?>?WZe ü?`RÈg?çwA?HÔ¿½;[^?	ÂD=·«¨ð½¶F)?ËÐ?%×B·¨4PÞ\:Ø?Ûa?øñXc«g<Wèc¹íèٳĥÃCeþ6ð§ÈâÁV]«ú|Ì?ÐÇ?õ°??åj´ÒîTñã¼?Ð?cSRÄ´8É{>?/¶à-ÔX?~¹\­Ç¸??ò	½ù$±ºÙr³~=>MQèÎÁòD?XÜtè#Å?¨a÷?ô±þùÞ?±Ár?ÀÙV:¬ó?ZEp
+{ÿ@%àåQÒì»?Ôç?K®tºêÂ3é«w0ù­´OÅa £?cÿrIØW?ü[%?-º×?ßÂÂV7CÈÏM?hÈ/µ¾q¯:Rà??,am­Ñë÷W?óö?f©?K?dÀaµ¨Â{Ô?#Ôu§Ò
Ó???å­Âõ??³?ôÁ?Ò.?
	Qúf?ÀÉp]1ùXoC}9Fk;ËR?B´?
?Ò?ËV¯?SîoT?±t¦9Åå?¿Ëã¤j`hç%µÒz?PNZ
,?ÑÐÀº\½5?Á¶w+)§F`?~íÎé?õu[QúåC׫\àï#æ?<çdl^?-ÛÐq?t0?öë.S-Wú9BXSo³1x½±KÄj¨Ò?Ý~í4"e=q#¾Ñ`à0¯¬X? ÒI¯w5í+eß¹ÏÖxWã&>TZïN]e9á??Áe?²Ðnßî?Z?~ÚøYT[µ^¹sô½:W?Fò?gZúµ,ª¿ÞUËq(kS¯??ÿ¶Pwý&Y îô??;Û$?s`?Âu_XÅ°ÙOeæRëüÒz;rm0¯,êc½?ðçfþX [ÛE¨SoM?¾6\Tí8gùå[kn:?ýÒ?¯4C¬?2-ã¬?"íá}Ù?L½?3?«I½]Èx
{cå¥àwÎrÄG?e_½µÐ?óäH¸ÃNfÖ¸'?(úý??]SX¶^¾Q¢`ÃZH·^"
,8?«=FON¨ÙõÀ°Ã~+õÆÂ?ù¶?°rÄóP?5W7-[ø-©9P¸<¯ú÷Gjqob7v¥Öy¤?²?mªå½?q¯?Ö?¯7ß}i_÷Ûm8ÏÊÊ3®¡s¤??AZ?L?Ë7çÒ?ÞÎô??o++?üÅÉ?²9ÑúêëCT?µ? :cb×,?BÕB¥?"¼?z{+ËÕÃÚúWö,?å´N?¬V$ð¨(þ
XÔbNî?v=d%	ÉÏ1A®}%Í­ºúx¢óU?ìF?g¾1¤ìæýavÃÐ?²':XÖ9eoÊàY?g
_Ö??LAUó]߸?7ü¶3?±à÷m?¼öæ&{ò
1îQCÊÆ?Z;M¾¦?¤??fO?°ÛQåøöB´½^? Få°àëxÀ°;²¡ÕéÔ¢÷RÑ@FþG?½Ùë¢hx: tи.DX£Q??F¯,øL{ÍÏr (Ã-sÌ?JÑGyt«?ßpz?f%"µGÑ>,È Ah_¸§ÂmõCïĽõ?Kï?`D²Z½??ÓxbÎ\³±Aû?­#?8°_WLÙknª(/Z´Æ¤îþ¼<<r[WoUMEGÅËУ?T¨*I<ª.l??ò?}µ¡¤j=
qøSZù2i~x:wc¸Ì{?xe4rá½?MNÚLÁö­Ì?íuZi¯???	?.c¾(m¦t{Í¢³`;}\??©¥ôæÌæ:gïWá^´têè×:&É??.?Z4?mG?-?6º??%]4×yé?æðÊ1é|?U)fýpPx7)i<ÂÜæS?V?Ñ­4#¿ªí?¯%¡!Â?ãîù?+¤??¾íÝR-?8?ô;vîq;¤º¶Ù*¥9ÌÁ?ÈÝ&iQFªE©°Û?ï?Å@??üýD]×c³?uÆ?µP®¿D?tQ?¬?'ÉÒO??7Ê
ö?[qÀß??ðöèÏ#*ÈK3<àÕêçTÌ1/ÌÙï?»?scës?J±z\MkïýZÀ±vTxÑ£Ðrì?ß©Ì7
R,ýgÜg1?íÒNz%??Ëw­ñJíø?´È¥PvÙ_yt?Ó¸ÿ/̵³[L?÷zøתÛ³?jܬ??Lé½úÏe??\Q2Ý?7B!¦0áÐúóÑ{®á+?7
ÛöÀõëõÀÌ\98vÄ(ó?äÑ?ÍYa¸pÔ6§ã%?¼+??Êz?8
jÒ9¹û¦Ò<?ZÞ«å×ù???Á?W?
×Ï??eBu¨~È?Ø+]ÃÛ~[ÛË?¸®,µ®l só²?Õ·£±sç?ü-Ya
Fbï
¨GÙ²?|È!
æE{H7	»?Õ(dgFØCx??ᨶ_2~VÒ¨z?Ì÷??R_<§Â¶0ýS?\=?¯??tké?³zÙ}?î[¡¬ÇÏSjcøÇtÉ+:?ó
óÔjÖtÔF×aùod?ÌoÉZ1ãÍ0eïöi;?õMHR»$ü6;·í£Þ?\PýéÂ?K?Dµ¯s+1;®ìãª_¢Ü?ݶϷzß­?L?CÈdLµw­:6Ê]?ø)?ó°ûÒÄ{ä°DMA)c×ãmïå6{÷8]8\$ï}îþF?^±?O9«m*?ï:ìúöTÁA¢búvÙ2E~?r·å$dW?Pù?ê£y³`ÅÕ?Öï(D·FÉ?a.Ð>®?éÉ
?gYÍ?ü«L¢ÕYÇä?Q
EØi:fp
ÂUW¿qa???ÞýÖ?/??®2?myÕ?ý;¼¿Lº?-tTÚVÞ!)?;ì5I©??PTT?²?	ݽ?»ÚF§GªîßßoiC¾pßßý7é?Í·pÛxÍjagpãÀû??SØyi²I4]N?w?T Jì??ëÔ§2åt??1r÷Ù?!óÜ.©s¼þr?¬ ã¶ÜjtÖ?o¿Gß??:ý©b¿ûÈíÆií>
ÿÔ»í???°²O?ÊèI?Ïû¾?~î¯CE×A·m,u¿ÄN%Sr[çÝ=?ìq/âcª\§.JWg?+%¿nÌQÄÎI<«_ß?¨vý)þÃÅ'?ijþäùbÆÕüdéÞBÑ:êÖ3§F?µÓ#??ò¤k®0àT??Û7"[È-n]P?ÙÆt?l.?rßMxYÂÐ?§Û?û4G6??<¿&}ó¤?§ËÎs?9R>O=ö÷ØM¯ßÏóÙy~àYØ?  ?¡D8ömsi?¹Bif¼ú}KI:ÚeHѤrsc§Ö®sï(Z»î??3{Ý?½Nwr"%{­âoq?8ÍÇÇ!Ǹ?c???Å?¾²Ñ+5³3Ñ!KÆcj
¢øhï¶#¼?¤ÒúF®äñÿæ"ê·Pk???c&¤âG=??1´Õ?ìø?3òF,??·I8ªèÏg^,¶ÚjéY8±80sBs«+¾?¹.:¥ti?µzÏá2É.\l?¢ÔÌ?ñ??y?M¶·¨ùíTR:ï¾}£EÚ'õß?dcϾ[¡x?0ãº52¶ësq[È++Öd?jµgS©dÿ±e;?¶«?{?9ø¶Rj®'ÍöÚU'ÆÔ# ÚëK£?%²=Å|éª??»?§?ükÿ?î#úD×?¼ÅÙèлÛ+$]©ýNw?M~°[1¶Í­	X0°?{?äº?¥¨U¿÷m²D½B24@ß­yU±éÁËÚÁcË?^TËîB{ç1aX@zk-¶¥ò£ZGà$#©sv§Çgf²?Tßÿ?É?V`¹Ë`>æp1w®îS+êf²ÔÞVeCL01å?üÞÖ¯1Ø©»?OÈRvl2ÐØtS7èïÓ³#'[Wòj¢gÿ?®²?$ï??Ù\«?Ù¹7ÿ?cô?Y?¸>??1º??àX£¸]/­£bT{tx?Òý?©æ?]Aï(çw5Îé~ÂbcNA?
ÑÁDÚ¸¼ÙÙ?v{ËéÄ©@¥??¿\§n?5øÉ}$
QX ñÎyëØî\?^¨ß?i;§??££_Ë??ĬîáÛº¹©?cx¶?²BSô°Á?zxw½?½ùì!öïë?"¿??G?|»§j?_MW?Ý_¡?ãÄ¡z~È 	¥?ë?ºu¤«e*??ÔĪß÷qqF?£uzBj«½ö>É»r?à^?q]~J?e¡§ÎûȽvßÑII6Ò
ý{Ó\¹Üªßàã_:§ìLª?£÷ý¬Ð¡µ:?x¸·ñ?åñ?Û_#ÄÏ*ìqç3?å5?LC.C}????±Ñ§>m¥c*.mzòTÖï §ÄUp?k¯ÓM?õÅÚ?«/j^Þ7v?ú¶òGkòå}÷núCè$Wàôj°V7?rn³Ñeó??b²ì!³oW"?Ë÷?øïÛn·ìþãÇÿ¤?­I¼*wñ?î?À¦¦NbL?í?'?`¶~ºwv½¹æN?Y#??««Y_[³?h¼Ù?»ax??ÿír½~íN?Ü%ñ?¹«léÎh?î¨h¿k·Y?ÝÉ?\¾³B§£ÞEÙvËV=jZ?áhºöpêg?¯ñ¢?àg?õÚyî??#½íq1¼á?<U5ç'ÎW.Qs"+?G%w?yù?ó¥\øÃV??2+[Û9?ɯ۵aÈÅ/[MýDÅïPÖ6
âOdªF?Ð??©ÕÕêÑNØmÕp??¶Â²Â z¼¶ÐuyÝFñèô
iJ??¶xn°ðD÷¢Xa椿×\ñ`º??úR××qB?%*üõéuÙ|UñÔz?òa/*vÂ*pmÚ´¨¢ÚðØ??®ÅNìVmh^4ùP&º×?qÐæÅÝ?k2ª(H;¬qQq|¸vÞH´Oµ¥öçbFàPEÉ´+rÃ6{kãùN®éº?Ò?¡.g6?ÎÑíS[þ]9?ïÔ´Væ*²;?:?Ù°³sTn*@æ_?O©ý)Q¿,KîÔør<ÁUÁTÝ?{þYð/!
I]M3ªÉÿÀ¹?gÁ?äÆͨ>éj?ý?ç?/
~¢?Õõ´ øà?ª?1:¶Ëí?écïùë´ü¬ª?1ú÷®§?UÕ1Fcº?>.8?ë}U;??4òìAï?(N?zÕóÄ0?~)xÐûª
ͧð_u³éÏþmà?(Î?zE?M¿<èsÕ?æSü¯?¹>W½²éYS!EÿêüáÉQï«»OoͦËÐfc§Bο-ø7dB,è?¬X tâ?E?ÇL Ä??8À?rñ@'XÄx<ÀÄB<è?¬x ?t?E?'L $??ÀJr?Î`ñÀÌ@x:Ö ?:h`?p4À 
:Ð??r?@'X$x"À$B"èH¬D ?t??E?'L $??$ÀJr ?Ç0 X ?:X`?p,À`:°??rÉ@'X$x2À$B2èH¬d ?tR?E
?§L
 ¤??ÀJr8 ?8Çp X8 ?:x`?p<Àà:ð??r?ÎC`ñÀÌC@x:ÖC ?
tR?E*?§L* ¤??TÀJUæ½K?¼uÉôx¡zÖoøÎæ?½Zßåïòwù»ü¯ËI?·?©g½0?ð?~§ßéwúÿ §yï?DÞºjz¼X=ë:¾³Ä|ªW+ø»ü??¹Î¦?DÝOÖ?~Íd¨yÑo?:?!_½6~ÍG®Ñ«Ä<2Ô¬­Ý?ä5Ú×"^ß^Q?\:°øc?ÞÈzöq«?÷?Ðò¶»ü	EîñWÄòWND]äH?U·^:Ö\Öþº#tÛw¯nos??Rf¸Ô7=?K/lÂFZkè²'2
í3H?\	v?a(æ3ü?¹£kÚÊVÐ?(I?ÿ4Ü3·#

Attachment: fixdistrib.png.gz
Description: PNG graphic showing the distribution of time-to-fix (in days)


Reply to: