“Adobe is aware of a report that CVE-2016-1010 is being actively exploited” • Hacker News Board

Re: “Adobe is aware of a report that CVE-2016-1010 is being actively exploited”

#41

Post by enzanki_ars » Fri, Mar 11, 2016, 6:02 PM UTC

dvfjsdhgfv wrote: post #30

jtokoph wrote: post #22

I'm a bit confused about the title of this post. The actual title of the blog post is "Security Updates Available for Adobe Flash Player (APSB16-08)". The current HN link text is “Adobe is aware of a report that CVE-2016-1010 is being actively exploited”. I can't help but think that the HN post has that title to give the impression that Adobe knows about an issue and isn't fixing it. But isn't this blog post an annou…

I think the intention here is to make people realize they should have disabled Flash a long time ago and use it only for a limited number of critical whitelisted websites (like banking sites built on Air). If you do otherwise, you're increasing the risk of being a victim of a malicious attack.

Out of curiosity, what bank do you know of that uses Air? That seems like a bank that someone should never use if they value security.

Re: “Adobe is aware of a report that CVE-2016-1010 is being actively exploited”

#42

Post by ajross » Fri, Mar 11, 2016, 6:46 PM UTC

icebraining wrote: post #33

ajross wrote: post #6

Earlier quoted context omitted.

Early PDF was quite sane. It was the Postscript imaging model turned into a binary bytecode format with almost all the programmability features removed. Later on it got wonky (though never even close to the extent to which Flash did!) with all the hypertextification features. But basic PDF is actually one of the Great File Formats in computer history.

The sane version is the one defined as the PDF/A ISO standard. Stuff like pulling remote resources, embedding executable code, etc are all forbidden. https://en.wikipedia.org/wiki/PDF/A

I didn't realize that this standard existed. Thanks for the link, that's very helpful to know. I've always viewed "modern PDF" as an ad hoc thing defined by the intersection of whatever was supported by the popular free renderers.

Re: “Adobe is aware of a report that CVE-2016-1010 is being actively exploited”

#43

Post by dvfjsdhgfv » Mon, Mar 14, 2016, 12:44 PM UTC

enzanki_ars wrote: post #41

dvfjsdhgfv wrote: post #30

Earlier quoted context omitted.

I think the intention here is to make people realize they should have disabled Flash a long time ago and use it only for a limited number of critical whitelisted websites (like banking sites built on Air). If you do otherwise, you're increasing the risk of being a victim of a malicious attack.

Out of curiosity, what bank do you know of that uses Air? That seems like a bank that someone should never use if they value security.

https://www.adobe.com/showcase/casestudies/raiffeisen/casest...

Marketed by Adobe as a "success story" - the customers are a bit less happy.