4 ms·
I'm not a fan of conspiracy theories, but this vuln was not patched in 90 days. Kaspersky frequently patches things faster than that, and this sure sounds like
by greglindahl 10y ago
I'm not a fan of conspiracy theories, but this vuln was not patched in 90 days. Kaspersky frequently patches things faster than that, and this sure sounds like it's a pretty trivial fix.
- tptacek 10y agoIt's kernel TLS interception code. Not only is it not a trivial fix, but Tavis Ormandy had to revise his exploit model to account for functionality he hadn't noticed. It's not a conspiracy.
- xorblurb 10y agoFixing that kind of stupid hashing scheme and subsequent use of only 32 bits of the result? Might not be trivial, but, regardless of being in the kernel or not, SHOULD be easy enough to fix quickly. Even more so given how bad that hole is. So, they taking too much time to fix that? In every case one more reason to stay far far far away from their products.
- tptacek 10y agoI'm not saying you should use Kaspersky AV. Don't do that.
- jonas21 10y agoSounds like it was patched: > This issue was fixed on the 28th, there was some delay unrestricting this bug due to the holidays. And it's been less than 90 days since the issue was reported, so they wouldn't have disclosed yet if it wasn't.
- greglindahl 10y agoAh, sorry, Nov 1 -> Dec 28 is 58 days.
- deleted 10y ago[deleted]