eEye Launches Zero-Day Vulnerability Tracker

Published: December 6, 2006

by Alex Woodie

Worried about zero-day exploits? You probably should be, according to eEye Digital Security, a Southern California security researcher and security software developer. Yesterday, eEye unveiled a Web portal where anybody can go to check on the latest zero-day exploits and prepare strategies to counter them.

According to eEye's Zero-Day Tracker portal, which is available at research.eeye.com/html/alerts/zeroday/index.html, there are seven zero-day vulnerabilities that are currently active, including six in Microsoft products, and one in an Adobe product.

In addition to tabulating a list of the problems, eEye tells you how many days it's been since the flaw was first discovered, which is something it offered previously on its research portal as a way to keep pressure on vendors to fix the problems. In some cases, the vendors appear to be very tardy with fixes. For example, the RPC Memory Exhaustion vulnerability in Windows was first found more than 380 days ago, and still hasn't been patched. Luckily, it's classified as a low-risk vulnerability, but there are plenty of unpatched high-severity risks for hackers to choose from.

The rise of zero-day exploits instigated eEye to launch the Zero-Day Tracker, says Marc Maiffret, eEye's founder and CTO. "The increasing proliferation of zero-day vulnerabilities means the previous window of opportunity IT had to secure networks between the release of a software patch and an attack has been slammed shut," he says.

"More zero-day security vulnerabilities and attacks are being discovered every day and dealing with them can easily dominate an enterprise's IT efforts. As a result, we've been overwhelmed by requests from our customers to give them the information and time they need to protect their networks. Our Zero-Day Tracker is a direct response to this tremendous demand," he says.