Critical Google Chrome hole plugged in 24 hours

http://arstechnica.com/business/news/2012/03/after-the-pwnage-critical-google-chrome-hole-plugged-in-24-hours.ars

by dbh937 • 14 years ago

46 25 14 years ago

sedev• 14 years ago

"To date, most successful attacks against Chrome exploit Adobe Flash, which is protected by a significantly more porous sandbox."

I notice that pretty much every time I read articles about Pwn2Own and similar. It's high time that Flash was abandoned as a ubiquitous part of the web. It is to web development as Outlook Express was to desktop software in the 90s - sure it's everywhere, but it's not doing much good by being so.

ja27• 14 years ago

I keep it disabled in Chrome and selectively enable it for sites I trust or as-needed. I'm glad to see that it's less necessary over time.

shrikant• 14 years ago

A thousand upvotes to you for this information.

If anybody else is looking, this can be done (without addons) under:

[Wrench] > Settings > "Under the Bonnet" Advanced Settings > "Privacy" Content Settings > Scroll down to "Plugins" and select "Click to Play". Manage exceptions as required.

kevs• 14 years ago

With a response time like that it seems like antivirus software is becoming increasingly irrelevant.

beatle• 14 years ago

Meanwhile, critical Android security holes remain unpatched for more than 2 yrs.

jrockway2• 14 years ago

A real security hole, or one like "if someone watches you type your PIN code, they'll know your PIN code"?

gcp2• 14 years ago

With exploits like that, it seems like sandboxing is becoming increasingly irrelevant.

I don't think it's a good argument - what about defense in depth? Don't antivirus packages have heuristic protections? Or are those, in general, useless?

fjarlq• 14 years ago

A lot of computer viruses are spread by confused or ignorant people. It's not all about security holes....

semenko2• 14 years ago

The Chrome Release blog says it's fixed: http://googlechromereleases.blogspot.com/2012/03/chrome-stab...

And that the SVN commit history is available: http://build.chromium.org/f/chromium/perf/dashboard/ui/chang...

But I don't see any commit that look even remotely related to this exploit. What's up?

palish• 14 years ago

Well... They would hopefully be smarter than committing the fix to the public SVN.

By committing the fix, they would effectively be releasing a step-by-step guide on how to exploit the vulnerability.

semenko2• 14 years ago

But it's still an open source project -- perhaps the commits are more evident in their git repo? http://git.chromium.org/gitweb/

Certainly if you build Chromium from git/SVN now, the bug is fixed.

I just find it a little strange that their changelog / list of commits in each version is not true.

jamesr2• 14 years ago

The commits are all there, the fixes just might not look completely obvious. We (chromium) commit all fixes to the chromium repository before pushing them to users, always.

vinhboy• 14 years ago

Do you guys ever do write-ups about the bugs? I would be interested in reading that.

emmelaich• 14 years ago

My wild-arsed guess is: http://src.chromium.org/viewvc/chrome/branches/963/src/conte...

-- a change to kUnreachableWebDataURL

gcp2• 14 years ago

That's only the Pwnium hack, though. The Pwn2Own vulnerability remains undisclosed and unfixed.

Which leads me to the question: why aren't companies like Google customers of companies like Vupen? Too many of them to make it cost-effective? Or does Vupen (for example) prefer if those holes are not fixed? You can sell a vulnerability many times, after all.

throwaway3823• 14 years ago

Vupen sells 0day exploits so that they can be used to attack people: http://www.vupen.com/english/services/lea-index.php

A patched vulnerability would not be worth nearly as much to them and their customers.

P.S. Vupen sells to ASEAN. ASEAN includes Burma (Myanmar). Burma is not a happy place.

dhbanes• 14 years ago

How hard would it be for Google to be a customer of Vupen without representing themselves as Google?

Critical Google Chrome hole plugged in 24 hours

Related Stories