4 ms·

Adobe just patched several remote code execution vulnerabilities in the latest update in the past month, don't you think it's a little premature to state that t

Adobe just patched several remote code execution vulnerabilities in the latest update in the past month, don't you think it's a little premature to state that them patching shader compilation to prevent exploit is something that will literally never be solved ever? More than likely, Adobe determined that it was much easier to secure a known slow path for shaders on the CPU than a fast GPU path. As a security-conscious user, I think I prefer that they adopted a quick fix that might have incurred a performance cost rather than put everyone else at continued risk for an indeterminate amount of time.

dietrichepp 13y ago
What really shows how much they care is the fact that it didn't even go in the changelog, apparently.
- AaronFriel 13y ago
  Are you assuming ignorance or malice? Here are a few options: * They were trying to intentionally hide this change to spite you * They were avoiding unintentional disclosure of the attack vector for this vulnerability (indeed, none of the CVEs that I could find for this month's Adobe Flash update describe the attack) * The security hand didn't talk to the changelog hand * The security team worked independently of the perf team, and perhaps this case wasn't thoroughly tested or the regression not detected And so on, and so forth. Let's be honest, there are lots of reasons we can imagine why Adobe did this, but imagining things doesn't make them true.
  - dietrichepp 13y ago
    It doesn't matter whether it's ignorance or malice. I don't have to imagine anything, because what I care about is whether changes that affect me are in the changelogs.
frenger 13y ago
It was marked as "never fix", though.
- AaronFriel 13y ago
  I'm so glad we're able to read so much into so few words. Today I learned: "never fix" means they will never ever solve the problem when it's used on a bug report submitted due to a performance regression on what might have been a zero-day vulnerability with in-the-wild attacks: > Adobe is aware of reports that CVE-2013-0633 is being exploited in the wild in targeted attacks designed to trick the user into opening a Microsoft Word document delivered as an email attachment which contains malicious Flash (SWF) content. The exploit for CVE-2013-0633 targets the ActiveX version of Flash Player on Windows. > > Adobe is also aware of reports that CVE-2013-0634 is being exploited in the wild in attacks delivered via malicious Flash (SWF) content hosted on websites that target Flash Player in Firefox or Safari on the Macintosh platform, as well as attacks designed to trick Windows users into opening a Microsoft Word document delivered as an email attachment which contains malicious Flash (SWF) content. Yes, that's a reasonable reaction.
relix 13y ago
If you read the comments on the report (and specifically Jing's comments, who works for Adobe), you'll notice that they imply it will never be solved ever. The bug report was written a few days after the release of the player that contained the crippling. Note that we had to find out through other ways than a changelog in Flash what was wrong. The Adobe worker said they had to disable JIT compilation because of a security issue and didn't have the time to fix it before the release. A month after the bug report was created, he implied through asking for votes and by apparently talking to management, that he'll try to get it fixed in a future release. We waited another month and now he closed the bug, added "NeverFix", and gave alternatives that are a joke. If that isn't a NeverFix, I don't know what is. If you know have inside information on this, please do share.

dietrichepp 13y ago

What really shows how much they care is the fact that it didn't even go in the changelog, apparently.

AaronFriel 13y ago
Are you assuming ignorance or malice? Here are a few options: * They were trying to intentionally hide this change to spite you * They were avoiding unintentional disclosure of the attack vector for this vulnerability (indeed, none of the CVEs that I could find for this month's Adobe Flash update describe the attack) * The security hand didn't talk to the changelog hand * The security team worked independently of the perf team, and perhaps this case wasn't thoroughly tested or the regression not detected And so on, and so forth. Let's be honest, there are lots of reasons we can imagine why Adobe did this, but imagining things doesn't make them true.
- dietrichepp 13y ago
  It doesn't matter whether it's ignorance or malice. I don't have to imagine anything, because what I care about is whether changes that affect me are in the changelogs.

frenger 13y ago

It was marked as "never fix", though.

AaronFriel 13y ago
I'm so glad we're able to read so much into so few words. Today I learned: "never fix" means they will never ever solve the problem when it's used on a bug report submitted due to a performance regression on what might have been a zero-day vulnerability with in-the-wild attacks: > Adobe is aware of reports that CVE-2013-0633 is being exploited in the wild in targeted attacks designed to trick the user into opening a Microsoft Word document delivered as an email attachment which contains malicious Flash (SWF) content. The exploit for CVE-2013-0633 targets the ActiveX version of Flash Player on Windows. > > Adobe is also aware of reports that CVE-2013-0634 is being exploited in the wild in attacks delivered via malicious Flash (SWF) content hosted on websites that target Flash Player in Firefox or Safari on the Macintosh platform, as well as attacks designed to trick Windows users into opening a Microsoft Word document delivered as an email attachment which contains malicious Flash (SWF) content. Yes, that's a reasonable reaction.

relix 13y ago

If you read the comments on the report (and specifically Jing's comments, who works for Adobe), you'll notice that they imply it will never be solved ever. The bug report was written a few days after the release of the player that contained the crippling. Note that we had to find out through other ways than a changelog in Flash what was wrong. The Adobe worker said they had to disable JIT compilation because of a security issue and didn't have the time to fix it before the release. A month after the bug report was created, he implied through asking for votes and by apparently talking to management, that he'll try to get it fixed in a future release. We waited another month and now he closed the bug, added "NeverFix", and gave alternatives that are a joke. If that isn't a NeverFix, I don't know what is. If you know have inside information on this, please do share.