3 ms·

I think it's worth pointing out that this vulnerability is being exploited by people opening Word docs (on Windows) that they get via a phishing email. The last

I think it's worth pointing out that this vulnerability is being exploited by people opening Word docs (on Windows) that they get via a phishing email. The last 0-day exploit against Flash that I saw posted on HN was the same thing but for a swf embedded in Excel. Not that these things aren't bad, but saying "Flash 0-day" sounds an awful lot more doomsday-ish than "0-day exploit if you open an attachment from a phishing email". Not trying to make excuses for Adobe, but people around here are pretty quick to jump on the overly-dramatic bandwagon when it comes to Flash.

peepasaur 16y ago
Agreed. There some fear-mongering with that type of headline. Of course, I had no idea that flash could even be embedded in Office applications.
- edge17 16y ago
  I mean... they just want to look responsible. If they'd toned it down, people would have accused them of not taking things seriously enough. It's better for them to seize the situation and own it rather than let the press have a field day and then spend time having to explain themselves. That's just my 2c...
- yuhong 16y ago
  Support for embedding ActiveX controls in documents has been there since Office 97.
jrockway 16y ago
This is not overly dramatic. Flash can now compromise your entire computer simply by your browser being directed at malicious content. It may be a search result, or a link, or an email... you click, and your entire computer is compromised. All your data could instantly disappear. All your money could be drained from your bank account. Remote exploits that require no abnormal user action are fucking serious.
- dougmccune 16y ago
  But that's not what the exploit is. It's an exploit against a swf file embedded in a Word doc. So you have to open a bad Word doc. There's no evidence to suggest "you click, and your entire computer is compromised". This isn't just any random swf file on the web that you access with a browser (ie a search result or link). Instead it's "you get sent a shady email with an attachment, you ignore your better judgement about not opening shady attachments in emails, and then you're compromised".
  - trotsky 16y ago
    This flaw was packaged in a doc and spear-phished to specific people to achieve a specific goal. You are confusing features like "embedded in a .doc" and "unregulated by things like flashblock or noscript" with a limitation. While the initial attack is uninterested in you, these things spread widely. There is nothing that has been reported that suggests it is limited to this delivery vehicle - I would assume it is not. In my experience, 2nd or 3rd order exploitations will be active before an adobe fix is released.
    - seanalltogether 16y ago
      I think his point was that this exploit was done outside of a browser sandbox, which places it in a whole new category of security issues. You could just as easily say this is microsofts fault for not applying stricter policies on activex controls within office products.

peepasaur 16y ago

Agreed. There some fear-mongering with that type of headline. Of course, I had no idea that flash could even be embedded in Office applications.

edge17 16y ago
I mean... they just want to look responsible. If they'd toned it down, people would have accused them of not taking things seriously enough. It's better for them to seize the situation and own it rather than let the press have a field day and then spend time having to explain themselves. That's just my 2c...
yuhong 16y ago
Support for embedding ActiveX controls in documents has been there since Office 97.

jrockway 16y ago

This is not overly dramatic. Flash can now compromise your entire computer simply by your browser being directed at malicious content. It may be a search result, or a link, or an email... you click, and your entire computer is compromised. All your data could instantly disappear. All your money could be drained from your bank account. Remote exploits that require no abnormal user action are fucking serious.

dougmccune 16y ago
But that's not what the exploit is. It's an exploit against a swf file embedded in a Word doc. So you have to open a bad Word doc. There's no evidence to suggest "you click, and your entire computer is compromised". This isn't just any random swf file on the web that you access with a browser (ie a search result or link). Instead it's "you get sent a shady email with an attachment, you ignore your better judgement about not opening shady attachments in emails, and then you're compromised".
- trotsky 16y ago
  This flaw was packaged in a doc and spear-phished to specific people to achieve a specific goal. You are confusing features like "embedded in a .doc" and "unregulated by things like flashblock or noscript" with a limitation. While the initial attack is uninterested in you, these things spread widely. There is nothing that has been reported that suggests it is limited to this delivery vehicle - I would assume it is not. In my experience, 2nd or 3rd order exploitations will be active before an adobe fix is released.
  - seanalltogether 16y ago
    I think his point was that this exploit was done outside of a browser sandbox, which places it in a whole new category of security issues. You could just as easily say this is microsofts fault for not applying stricter policies on activex controls within office products.