Technology reseller, Channel Reseller, just posted the latest security report (data from Secunia) identifying the most dangerous and most attacked applications and also the most vulnerable operating systems.

The report found that Mozilla’s Firefox and Apple’s Safari ranked No. 1 and No. 2 respectively as the most vulnerable third party applications. Mozilla Firefox contained a total of 96 vulnerabilities while Apple’s Safari thus far had 84.

According to the report, both Web browsers outranked Adobe products Reader and Acrobat, which each contained 61 vulnerabilities, as well as Flash Player and AIR, which each contained 51 security flaws.

The most prevalent attack vector during the first 6 months of 2010 was via remote code execution, meaning that hackers could exploit the majority of security flaws remotely with little or no user intervention required. Vendors typically rate vulnerabilities that allow remote code execution attacks with the highest severity rating of “critical.”

The report also points to a decisive upward trend in security vulnerabilities. During the first six months of 2010, researchers have detected 380 vulnerabilities, representing 89 percent of the total number for all of 2009.

And, interestingly, Microsoft does not lead the pack as the most vulnerable “platform”. That honor goes to Apple who is leading with the highest number security vulnerabilities reported. Rounding out the top 10 vulnerable platforms are: Oracle, Microsoft, HP, Adobe System, IBM, VMware, Cisco, Google and Mozilla Organization.

- Nancee Melby, Director of Product Marketing

Not really, but it is the last date that Microsoft will deliver patches for what may have been its most popular operating system/service pack combo. Yes, it is true. Windows XP SP2 has officially reached end of life. Rest in peace.

This seems to have caught people by surprise. A quick check of the stats from our customer base (both NetChk Protect and IT.Shavlik.com) indicates that about 16% of the target machines managed by Shavlik are running XP SP2 as their operating system.

In a story that appeared on Daniweb by Davey Winder, Qualys estimates that it will take a year before everyone can migrate off XP SP2.

Why should you care? This article from Computerworld sums it up best: You shouldn’t. The vulnerabilities in Windows XP SP2 that Microsoft will no longer fix aren’t your biggest problem. Your biggest problem is the vulnerabilities in non-Microsoft applications like Adobe Reader and Flash, Apple QuickTime, and Sun JRE that you’ve been ignoring for years.

News flash folks: hackers and those with malicious intent to infiltrate your environment and steal sensitive data aren’t focused on Microsoft operating systems any longer. They are targeting 3rd party applications…and in a big way.

From the Computerworld article titled “How to Keep Windows XP SP2 safer after Microsoft stops patching“:

Antivirus vendors McAfee and Symantec have both reported huge surges in attacks exploiting bugs in Adobe’s Reader, one of the most widely-installed plug-ins. McAfee, for example, said that exploits of Reader jumped 65% in the first quarter of 2010 compared to 2009′s total.

There you have it. Wring your hands in angst over the fact that XP SP2 is EOL. But then dust yourself off and start addressing the real threat to your data…unpatched Adobe, Apple, Sun, and Mozilla products.

Think you’re covered? Then I’ll extend a challenge. Register for IT.Shavlik.com. Check 10 machines in your environment (you can scan and patch up to 10 machines FREE). You’re not as patched as you think you are and IT.Shavlik.com will prove it.

Then, call me. Shavlik can help.

– Nancee Melby
– Director of Product Marketing, Shavlik

Dell bought KACE.

Emerson is shopping LANDesk.

And now, IBM announces it will buy BigFix.

Mergers and acquisitions of Information Technology companies are not new. Globalization has fueled those activities for years.

But with the acquisition of BigFix by IBM, Shavlik becomes the last vendor focused on SMB and mid-market who hasn’t succumbed to the lure of big names and deep pockets and a troubled economy.

Which is good news for companies in the SMB market space.

Shavlik is strong and independent. We continue to innovate to solve problems for our customer base. Mark Shavlik has worked with and beside IT administrators for more than 25 years — inside and outside of Microsoft. While every high tech vendor on the planet is clamoring to attach “Cloud Computing” to its offerings, Shavlik has done more than just whitewash (or perhaps I should say cloud wash) our flagship product NetChk Protect and slap a cloud brand on it. No. With IT.Shavlik.com, we deconstructed the entire user interface and built a UI and user experience that changes the way we will manage our IT assets now and well into the future.

But we entered the Cloud Computing space in a way that makes sure our innovations spread across our product lines. We use a shared technology stack between the NetChk Platform and IT.Shavlik.com. With either offering, you get the same great patch data and engines, but you choose how you want to use it.

The blogosphere is ripe with opinions about the impact (demise or re-energize) of BigFix as a result of IBM acquisition. Mike Rothman of Securosis wrote a fairly balanced analysis.

And while you’re cruising the Internet, checkout IT.Shavlik.com. You’ll be glad you did.

So, now we don’t know if Brad Arkin, Adobe’s director of product security and privacy, was inaccurate or premature. Stay tuned.

Following on the heels of this confusion, Adobe announced critical flaws in Flash, Reader, and Acrobat. Surprise, surprise.

In a post to patchmanagement.org Friday, June 4, 2010, Susan Bradley wrote:

Adobe Warns of Critical Flaw in Flash, Acrobat & Reader – Krebs on Security:
http://krebsonsecurity.com/2010/06/adobe-warns-of-critical-flaw-in-flash-acrobat-reader/

The company notes that the /Flash Player 10.1 Release Candidate/, available from this link <http://labs.adobe.com/technologies/flashplayer10/>, does not appear to be vulnerable. Adobe also said Adobe Reader and Acrobat 8.x are
confirmed not vulnerable. Further, Adobe Reader and Acrobat users can mitigate the threat from this flaw by deleting, renaming or removing
access to the “authplay.dll” file that ships with Reader and Acrobat (although users may still experience a non-exploitable crash or error
message when opening a PDF that contains Flash content).

The vulnerable component should be located at these spots for Windows users:

• Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\authplay.dll
• Acrobat: C:\Program Files\Adobe\Acrobat 9.0\Acrobat\authplay.dll

Adobe says it is working on an official patch for the problem. Stay tuned for more details.

This fast time to value we deliver to our customers is not new – Shavlik has always been known for this – but we continually raise the bar for ourselves as to what “fast” equates to. For the last several years, we’ve promised that in “30 minutes or less” you’ll be up and running with patch scanning and deployment for physical and virtual machines. Today however, we can promise our customers high value IT management in 90 seconds or less. Our new cloud-based solution, IT.Shavlik.com, provides our customers with a fast and easy way to immediately begin scanning their systems for latest software, hardware versions, patch status, VM status, and then deploy updates as needed. This is a web based interface with zero IT infrastructure required. IT.Shavlik.com runs on a cloud platform that Shavlik refers to as our OpsCloud.

Today IT.Shavlik.com is ideal for managing smaller business environments, but its value for mid sized and larger companies will scale over time. Even today a larger environment could easily leverage IT.Shavlik.com to quickly scan their systems as an audit effort to ensure their systems are fully up to date.

We hope that our customers and other friends of Shavlik will take a look at the new face of Shavlik today, visit our new web site, and see how easy it is to find out what we offer and get immediate access to all of our free software and downloads, just click Start Now from the home page.

Colleen Kulhanek
Director of Marketing
Shavlik Technologies

In the redmond.com article, writer Jabulani Leffall casts a wide net when taking Microsoft and Adobe to task for making patch management a never ending task.

Shavlik — Data Team Manager Jason Miller and I — were invited to be the featured speakers at a recent WMUG virtual user group. The session was recorded and is available at your convenience. Just click here to view it. Our topic was Shavlik SCUPdates. SCUPdates is a catalog file that feeds update information for non-Microsoft products (Adobe Reader, Adobe Flash, Apple iTunes, Apple Quicktime, Sun JRE, Mozilla Firefox, Skype, etc.) into System Center Configuration Manager. This enables System Center Config Manager to patch Microsoft AND non-Microsoft applications using the same workflow.

With the continued pain that patching 3rd party applications inflicts, this 30-minute session is well worth your time.

Shavlik Technologies has just made Greener IT a reality for companies of all sizes with the release of NetChk Protect 7.5 Plus Power Management.

Shavlik has extended our Patch Plus approach by integrating best-in-class patch management seamlessly with power management (and Wake-on-LAN) so customers can maximize energy cost savings while minimizing systems missed by critical security updates because they were powered off during scheduled maintenance periods.

New features in Shavlik NetChk Protect 7.5:

• Power off or put machines into hibernate or sleep mode on an immediate or scheduled basis
• Wake-on-LAN: “Wake-up” machines on the network on-demand or on a scheduled basis
• Agent Support for Asset Scans: Define asset scan tasks for the NetChk Agent for software assets and hardware assets
• Software Asset Scans of Offline Virtual Machines: Collect current software asset data from VMs regardless of power state

Upgrade to Shavlik NetChk Protect 7.5 today. The upgrade to NetChk Protect 7.5 is free to Shavlik customers with an active service agreement. Contact sales@shavlik.com to add Power Management today.

Nancee Melby
Director of Product Marketing
Shavlik Technologies

To whom it may concern at the Airport I’m flying out of this morning

When you install updates through whatever management service you use, can you make sure you flag the box to reboot preferably before 5:30 a.m.

which is when I arrived in the airport to see that EVERY gate information screen not only is running Window XP but had a “this system needs to be rebooted after automatic updates” message box stuck smack dab middle of the screen.

I’m sure your patching routine is hard to do and I wouldn’t wish it on anyone, but leaving the box in an unrebooted state leaves the system in an unstable, unpatched state.

Given that I also can’t figure out what you approved for patching last night — as I don’t read anything in

http://support.microsoft.com/kb/894199 was released to warrant pushing out, I’m hoping that these aren’t the patches from earlier in the month.  But since I’m not the admin of the airport, I’m not sure what you deemed proper to approve, let it install, but then not kick a reboot. I see more Win7 and Server 2008 updates including some updates to 2k8r2 best practice analyzers that said they may reboot the box but didn’t on mine.

I do find that you need to patch a test box to see which ones really will and which ones probably won’t need a reboot.

But bottom line people… updating without rebooting is only 1/2 of the job.  You gotta bounce that box before the job of patching is done.

I spent last week at the Microsoft Management Summit (MMS), April 19-22 in Las Vegas. While Microsoft finally added “cloud computing” to its massive vocabulary, the cloud announcements didn’t generate the most excitement and buzz. I’d have to say that honor belongs to Shavlik SCUpdates and the need to patch 3rd party applications.

We ended up with mentions in three of the biggest sessions at MMS. Bill Anderson, System Center program manager, demonstrated Shavlik SCUPdates in his “State of the Union” address. You can read about the State of the Union address in Kenny Buntinx’s blog. SCUPdates was also the topic of extended conversations at the System Center Updates (SCUP) breakout session and a session hosted by Dell, also on SCUP.

The need for an effective means for patching 3rd party applications was obvious to those in attendance. We had numerous conversations with System Center Configuration Manager users about the pain of researching and creating packages to deploy updates for non-Microsoft applications, especially Adobe Reader, Adobe Flash, Firefox, Quicktime, and Sun JRE. Many confessed they don’t have bandwidth to effectively patch these applications. They end up doing custom one-offs or doing nothing at all. The need is clear. The pain is obvious. Shavlik has the solution.

A System Center Config Manager administrator from a major oil company came by for a SCUPdates discussion following the State of the Union session. He came back later with some of his co-workers. He did all the talking. Then he came back a third time with his boss. Again, he did all the talking. We gave him a trial catalog file which he promptly sent back to his colleagues.

He came back a fourth time with questions from the home office.

That scenario played out numerous times. The interest in SCUPdates was very high. There is clearly a need, a pain that needs relief. If you want to get more information on how Shavlik SCUPdates will have you patching non-Microsoft applications in minutes using SCCM, register here and try it.

Nancee Melby
Director of Product Marketing

We will be offering a number of items on our Facebook page:

• Shavlik news, coverage and hot blog articles – all in one place.
• Video demos of the latest products and services.
• Our take on the latest industry news.  We’d like you to share items you think are important, too!
• A place for Shavlik employees, customers and like-minded industry professionals to interact and build relationships.

Shavlik Technologies on Facebook

This is YOUR forum.

We created this for you.  We are hopeful that you will come in to share successes, troubleshoot, ask questions and meet others.

We look forward to having a conversation.

Colleen Kulhanek
Director of Marketing
Shavlik Technologies