Report: Unix/Linux Vulnerabilities Triple Those of Windows

US-CERT's 2005 year-end index declared Unix/Linux logged more vulnerability reports in 2005 than market-dominant rival Microsoft (Nasdaq: MSFT) Windows. It's a revelation that probably has Bill Gates smiling, even though security experts are not buying into the report wholeheartedly.

By the Numbers

According to the numbers, US-CERT found 5,198 reported vulnerabilities in 2005. Broken down by platform, 2,328, or 45 percent, of those vulnerabilities were charged to Unix/Linux.

Another 2,058, or 40 percent, of the vulnerabilities were attributed to multiple operating systems. And only 801, or 15 percent, were credited to Microsoft systems. Tallied up, that means vulnerabilities found in Unix/Linux outpaced those discovered in Windows by three to one.

The Rest of the Story

It should be noted that US-CERT did not distinguish between Unix/Linux vulnerabilities and OS X vulnerabilities. Still, only about 25 vulnerabilities were attributed to Apple (Nasdaq: AAPL) systems.

If one looked solely at numbers, Apple would boast the safest systems. But there are far fewer Apple computers on the market than PCs. That, said analysts, is why you can't strictly count numbers.

What's more, US-CERT does not filter out updates. What that means is one vulnerability could actually be recorded multiple times. US-CERT also does not break out individual vulnerabilities from warnings that cover multiple bugs.

Who's Safer?

So what do these numbers really mean? The Linux versus Windows security debate is comparable to the Firefox versus Internet Explorer Web browser debate.

Ultimately, it's an argument between open-source and commercial software security. In the Web-browsing arena, Firefox is often declared the winner over Internet Explorer. But, again, the numbers collected by security researchers only tell part of the story.

Picking On the Attention Getters

One cannot make blanket statements about software safety, Michael Sutton, director of VeriSign company iDefense , told LinuxInsider. There are other factors, such as how the software is configured, that also play a role in security.

Take the Firefox versus Internet Explorer example. "It's too simple to say Firefox is safer than Internet Explorer or vice versa. Firefox and Opera and any other browser have vulnerabilities. The level of research that's put into them is certainly driven by how big the user base is," Sutton said.

Just as Internet Explorer has traditionally garnered the most attention from researchers, Linux has been the subject of scrutiny in past years. What is important is not merely the number of vulnerabilities, but how they are handled when they do occur.

As the platform security debate continues, what is clear is that the overall number of vulnerabilities is on the rise. US-CERT recorded 171 vulnerabilities in 1995. Five years later that number had more than quadrupled to 1,090. And this year saw 2,210 more vulnerabilities than last year.