A selective look at response times

It is often said that, while free software suffers from security flaws just like the proprietary variety does, fixes for those flaws come out much more quickly. For most users, however, security patches do not arrive until packaged by their distributor. So, every now and then, it is worthwhile to take a look at how quickly various distributors manage to get the fixes out. The following table lists a subset of recent vulnerabilities and the number of days required for each distributor to issue an update. For the purposes of this table, the clock starts when a vulnerability is disclosed, or when the first distributor alert is issued, whichever comes first.

Vulnerability	Distributor
	Debian	Fedora	Gentoo	Red Hat	SUSE	Ubuntu
Apache mod_ssl	--	--	--	11	--	12
clamav	22	--	3	n/a	--	--
evolution	--	1	13	19	--	--
fetchmail	22	0	4	4	--	5
PCRE	13	4	14	--	16	3
PHP XML-RPC	9	4	5	6	7	4
PHP XML-RPC 2	18	10	9	4	15	5
ProFTPd	35	--	4	n/a	--	n/a
vim modeline	--	16	--	28	--	1

The above table lists a subset of relatively important vulnerabilities disclosed since July, 2005. Distributions marked "n/a" do not ship the vulnerable package; a marking of "--" means that the update has not, yet, been released. Missing updates can mean one of two things: (1) the distributor simply has not gotten around to releasing an update yet, or (2) the relevant package is of the second class citizen variety, such as those found in Fedora Extras or Ubuntu's Universe.

Even though the set of vulnerabilities above is relatively small, some patterns emerge. Some distributors (Fedora, Gentoo, Debian, Red Hat) have managed to close most of the listed vulnerabilities. A couple of others have fallen seriously behind, however, leaving users running vulnerable software. Some distributors tend to be quite fast in getting updates out; others are slower. Perhaps the biggest surprise is the current lag time on Debian's updates; Debian used to be one of the faster distributions to get updates out.

It is worth noting, as well, that the increasingly popular "non-core" package repositories can be a hazard for administrators who are not paying attention. Clamav is used as a virus filter on many sites, and the recent vulnerability is real and exploitable. An administrator who relies upon a distribution's update mechanism may not have noticed that, when she used yum or apt-get to install clamav, it came from Fedora Extras or Ubuntu Universe. As a second class citizen package, clamav will not be updated by the distributor, and will remain vulnerable for an unknown period of time. Any security-conscious site which uses such packages should have a mechanism in place to note and respond to security problems in those packages.

---

to post comments

Vulnerability                     Distributor
                Debian  Fedora  Gentoo  Red Hat SUSE    Ubuntu  Slack   Mand'va
Apache mod_ssl  --      --      --      11      --      12      14      13
clamav          22      --      3       n/a     --      --      n/a     4
evolution       --      1       13      19      --      --      n/a     7
fetchmail       22      0       4       4       --      5       2       7
PCRE            13      4       14      --      16      3       11      9
PHP XML-RPC     9       4       5       6       7       4       11      -1
PHP XML-RPC 2   18      10      9       4       15      5       16      7
ProFTPd         35      --      4       n/a     --      n/a     --      18
vim modeline    --      16      --      28      --      1       --      28

 	 	SUSE
Apache mod_ssl  14 (a day too late for this article)
clamav 		 1 
evolution 	--
fetchmail 	 6
PCRE 	 	16
PHP XML-RPC 	7 
PHP XML-RPC 2 	15
ProFTPd 	n/a
vim modeline 	n/a (*)