3 ms·
But that's not what the exploit is. It's an exploit against a swf file embedded in a Word doc. So you have to open a bad Word doc. There's no evidence to sugges
by dougmccune 16y ago
But that's not what the exploit is. It's an exploit against a swf file embedded in a Word doc. So you have to open a bad Word doc. There's no evidence to suggest "you click, and your entire computer is compromised". This isn't just any random swf file on the web that you access with a browser (ie a search result or link). Instead it's "you get sent a shady email with an attachment, you ignore your better judgement about not opening shady attachments in emails, and then you're compromised".
- trotsky 16y agoThis flaw was packaged in a doc and spear-phished to specific people to achieve a specific goal. You are confusing features like "embedded in a .doc" and "unregulated by things like flashblock or noscript" with a limitation. While the initial attack is uninterested in you, these things spread widely. There is nothing that has been reported that suggests it is limited to this delivery vehicle - I would assume it is not. In my experience, 2nd or 3rd order exploitations will be active before an adobe fix is released.
- seanalltogether 16y agoI think his point was that this exploit was done outside of a browser sandbox, which places it in a whole new category of security issues. You could just as easily say this is microsofts fault for not applying stricter policies on activex controls within office products.