4 ms·
Unless the backported fix didn't actually remove the vulnerability. Or the vulnerable systems reported as being fixed without actually being so because of anoth
by y4mi 5y ago
Unless the backported fix didn't actually remove the vulnerability. Or the vulnerable systems reported as being fixed without actually being so because of another bug. There are a lot of imaginary situations that could've happended.
There should be an in-depth analysis from this, but I don't think it's safe to really draw conclusions about their processes from what we know from this exploit alone.
- raesene9 5y agoGiven that the Azure notification provided zero details on the patching, I think we can apply Occam's razor here quite effectively. One the one hand we have an old version with a known vulnerability that was successfully exploited. On the other hand we have a backporting process for 5 years that applied fixes to this and a large number of other issues but missed the exploitable vulnerability. Sure we can come up with imaginary scenarios where the second option is possible, but when reasoning about a scenario from limited information I generally go with the simplest possible explanation.
- y4mi 5y agoIf you start of using Occam's razor and skip the analysis entirely as you're seemingly fine with you'll just end up with a confirmation bias by only looking at signals which collaborate with what you want to be the truth.
- raesene9 5y agoSure and if we were skipping the analysis here, I'd agree with you. However we have several signals from the researcher side, and no signals (that I've seen) from the vendor side and all of the signals point to a lack of patching. In this case are there any signals you've seen that point to silent backporting that missed the exploited vulnerabilities?