Security Vendors Offer Free Zero-Day Tools

Two security companies have posted information and tools to help users track so-called "zero-day" bugs and sniff out software vulnerable to attack.

On Tuesday, eEye Digital Security launched a Web site that posts information on current unpatched bugs for a variety of vendors' products, including those from Microsoft, Adobe, Apple, and others. As of Wednesday, the Zero Day Tracker site listed six zero-day vulnerabilities; all six affected Microsoft software.

"More zero-day security vulnerabilities and attacks are being discovered every day, and dealing with them can easily dominate an enterprise's IT efforts," said Marc Maiffret, eEye's chief technology officer, in a statement. "We've been overwhelmed by requests from our customers to give them the information and time they need to protect their networks." The tracking site provides links to workarounds and additional analysis of each zero-day vulnerability, and also notes the number of days since the bugs were first publicly disclosed. When a vulnerability is patched, the site shifts the description to an archive section.

"The increasing proliferation of zero-day vulnerabilities means the previous window of opportunity IT had to secure networks between the release of a software patch and an attack has been slammed shut," added Maiffret.

Wednesday, Danish vulnerability tracker Secunia debuted a free examination tool for Windows PCs that detects vulnerable versions of several popular software classes, including Web browsers, media players, and e-mail and instant messaging clients. The Secunia Software Inspector also claims to be able to tell whether Windows is up to date.

The tool uses a subset of Secunia's for-a-fee file signature database, which contains updated information on more than 4,000 applications. The database and Secunia's commercial services target enterprises that want to seek out unpatched and possibly vulnerable applications.

Software Inspector runs within Internet Explorer 6.0, Firefox 1.5, or Opera 9.0 and later, and requires Java JRE 1.5.0_06 or later.