Security Holes.. Who cares?

Eric Rescorla
RTFM, Inc.
First version: November 15, 2002

We report on an observational study of user response following the OpenSSL remote buffer overflows of July 2002 and the worm that exploited it in September 2002. Immediately after the publication of the bug and its subsequent fix we identified a set of vulnerable servers. In the weeks that followed we regularly probed each server to determine whether it had applied one of the relevant fixes. We report two primary results. First, we find that administrators are generally very slow to apply the fixes. Two weeks after the bug announcement, more than two thirds of servers were still vulnerable. Second, we identify several weak predictors of user response and find that the pattern differs in the period following the release of the bug and that following the release of the worm.

Note: Our initial collection of vulnerable servers was limited to servers which advertised vulnerable versions of OpenSSL. We did not directly probe them with the procedure of Section 4.2 because we did not yet have the vulnerability details. The "100%" data point on Figure 1, Figure 8, and the curve fit in Section 5.2 is based on the vulnerability announcements indicating that all then-current versions of OpenSSL were vulnerable. Subsequent data points are based on direct measurements.

Full paper in PDF and PS

RTFM Home Page