Do Windows application vendors really care about security? For many of them, it's a fair question. We're coming up on 6 years since Microsoft introduced DEP (Data Execution Prevention) into Windows XP SP2, a version so old that it's about to exit its support lifecycle. And yet, as Secunia shows in a recent survey, many of the most popular 3rd party Windows programs don't support it.

DEP prevents execution of programs in areas of memory reserved for data, the technique used to gain program control in the large majority of application vulnerabilities. There are ways around it, but these largely fail in the face of another protective technique, ASLR (Address Space Layout Randomization) introduced by Microsoft in Windows Vista. ASLR randomizes the location in memory of program code.

In order to use either DEP or ASLR, programs must opt in to them. And both can expose subtle non-security bugs in programs and challenge some programming techniques. This is just one reason why many app vendors don't bother with them, even though their value is well-understood. Of the app vendors in their survey, few use ASLR at all, and it turns out that many programs' use of ASLR is a sham. Here are Secunia's results for their most recent tests:


The results are shocking, but my observations don't quite agree with Secunia's. Let's take it app-by-app:

  • Adobe Flash Player—Secunia's reasoning for listing DEP as "N/A" seems to be that a researcher demonstrated several months ago a way to bypass both DEP and ASLR in Flash. But they also note that the current version ( detects and blocks this attack. I don't see any reason to call this anything less than a YES. As they note, ASLR is functioning properly in the current version.

  • Sun Java JRE—DEP FAIL, ASLR FAIL. My tests confirm Secunia's reports.

  • Adobe Reader—DEP has been enabled for Vista and Win7 for a long time but, ironically, only recently for Windows XP. ASLR is basically set, but one DLL is loaded at a fixed address on non-IE browsers. Strangely, the ActiveX version is safer! ASLR is also full-blast in the standalone reader. Note that PDFs can embed Flash objects, so all Flash vulnerabilities are Acrobat vulnerabilities.

  • Mozilla Firefox—Much like Adobe Reader, DEP has been on for a while for Vista and Win7, but only fairly recently for XP. ASLR is enabled, but it's basically a sham: 10 DLLs in Firefox load at a fixed base address, defeating the whole purpose. One wonders if they set the ASLR bit purely for marketing purposes.

  • Apple QuickTime Player—Secunia says that DEP was not enabled on their QuickTime 7.6.6, but it was for me. It's not set as Always On (permanent), meaning that the user can't opt out of it, which perhaps is where the confusion comes from. ASLR is not enabled, although Secunia says that libraries are generally randomized when loaded; perhaps they wrote their own loader.

  • VLC Media Player—Secunia says that VLC does not enable DEP and loads multiple libraries at fixed addresses.

  • Apple iTunes—The current version of iTunes ( enables DEP and ASLR. Secunia says that their ASLR is negatively affected by a couple of fixed-address libraries, but from what I see it's worse than that: Because I installed iTunes I ended up installing a number of other programs which load when I run iTunes, including iPodServices.exe and AppleMobileDeviceService.exe, neither of which have either DEP or ASLR enabled. Fail.

  • Google Chrome—YES all the way, as I see in my own system. Chrome, like Internet Explorer, also runs at low integrity, further limiting the damage it can do if it is compromised.

  • Adobe Shockwave Player—DEP may be on depending on your browsers; ASLR may be on, but several libraries are loaded at fixed addresses anyway.

  •—DEP is not enabled. Secunia says that the IE ActiveX control loads at a fixed address, but doesn't specifically say if ASLR is otherwise enabled.

  • Google Picasa—Neither DEP nor ASLR are enabled.

  • Foxit Reader—Secunia tested Foxit Reader They found DEP disabled and both the plugin and ActiveX control loading at fixed addresses. Since they tested Foxit has released version which I tried with the same results.

  • Opera—DEP is enabled, but Opera.DLL is loaded at a fixed address, so ASLR is not real. Those are basically the only two binaries from Opera and the DLL is the great bulk of the great bulk of the code, so ASLR is a total phony here. Secunia tested Opera 10.53, but I tested the new 10.60 and got the same results.

  • Wimamp—DEP was not enabled in version 5.572 for Secunia. They don't mention ASLR and I didn't test it.

  • RealPlayer—DEP was not enabled for Secunia in the SP 1.1.4 version. They report that plugins are loaded at fixed addresses. I don't let software from Real on any of my computers so I didn't test.

  • Apple Safari—DEP is enabled as is ASLR in the latest version 5.0, but at least one DLL is loaded at a fixed address.

In a number of cases above Secunia puts a "no" in their table when there is partial support, such as Shockwave's DEP in some browsers but not others. This seems misleading to me.

But I do want to thank them for bringing to my attention the false support for ASLR in some of these programs, as they set the bit for their main image load but then load DLLs at fixed addresses. Shame on you Adobe, Apple, Mozilla and Opera.

And it's worth noting that Foxit Reader gets a lot of attention and installs as a supposedly safe alternative to Adobe Reader. While you may be safer for the fact that Foxit isn't targeted in the way that Adobe's Reader is, Foxit Software appears to be putting a lot less effort into their security than Adobe.

Hat tip to KrebsonSecurity.

Originally posted to the security blog, Security Watch.