Some of the biggest names in the IT software business still <A HREF="http://securitywatch.eweek.com/patches/big_vendors_still_very_tardy_on_fixing_security_flaws_1.html?kc=EWKNLNAVFEA1">are very lax when it comes to fixing security holes</A> reported by third-party brokers.

According to a list maintained by TippingPoint's Zero Day Initiative, Microsoft, Novell, Oracle, Computer Associates and Hewlett-Packard are among the vendors most tardy about shipping fixes for known flaws that could be used in code execution attacks.

Microsoft, for example, has nine "high risk" vulnerabilities on the list. Three of the nine Microsoft product flaws were reported more than 404 days ago.