Gloves on as Googler deposits foul zero-day on Kaspersky lawn Google security man Tavis Ormandy has revealed a dangerous remote zero day vulnerability in Kaspersky kit that grants attackers system privileges. The bug is a remote "zero interaction" buffer overflow affecting default installation configurations of the latest anti-virus software versions. "So, about as bad as it gets," …
"[This] clearly makes it difficult as possible for a corporation to put together a response for concerned users," Cluley says.
Should that not read "an unconcerned corporation to put together a response for concerned users"? Sorry if it's inconvenient, but after all this is the work they get paid for.
Public holiday aside. The more interesting is the double standard when US corporations are given 90 days by policy (which they still think is not enough) and the ENEMY is given a nice rounded ZERO.
Now, anyone complaining that the ENEMY starts to treat us as an ENEMY after that should just go STFU.
Not sure about Kaspersky but lots of companies don't patch or certainly not quickly when informed of a vulnerability. Publicly disclosing it exists is a good way of forcing the hand of corporations as a little public shaming can go a long way in ensuring the patch gets proper priority and resources.
"2 year old Android phone"
Is it a Google Nexus Phone or a PE phone? If so they should have all the fixes already, if not then surely it is up to the manufacturer to fix the issues that Google have provided the patches for. As the manufacturer and the carrier has to put out the fix, surely it would then be their responsibility?
"What happened to 90 days?"
Nothing. If you want to give 90 days then go right ahead and do so.
If it happens to be a Volkswagon bug that's more than long enough for them to slap a gagging order on you.
Back on topic: It's nice to see Kaspersky's response. No bitchiness, just getting on with the patch.
To b fair to Kaspersky, the fix was announced and deployed within 24 hours of disclosure, and for end-users with automatic updates enabled (as they are by default), the patch will have been in place before this article was published. It also seems that Ormandy's public disclosure was sufficiently vague to have made exploitation in that brief window unlikely.
Given that almost all software will be found at some point to have security vulnerabilities, if anything Kaspersky's rapid response has increased my respect for the company.
Kaspersky labs (in spite of many attempts to slime them in the press) are always up-front and responsive to any concerns or problems in their products. The notion of "go public so something is done" is total BS in this case. The only reason to go public first is so Ormandy can publicly beat his chest. If he notifies Kaspersky first, they fix it and he loses his thunder.
Shame on Ormandy for his cheap shot for public credit.
Kudos to Kaspersky Labs for their usual quick and sincere response... and also for not calling Ormandy out for the attention-grabbing stab in the back.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
