MUST READ: Microsoft unleashes bug bounty program — for betas, too

Topic: Browser

Discover

Google engineers claim that Chrome PWN bug is a Flash bug

Summary: Yesterday I reported that security firm VUPEN claimed to have a Google Chrome browser exploit that bypassed the browser's sandbox and Windows ASLR and DEP security measures. Today Google engineers are claiming that the bug isn't with Chrome itself but in the Flash player bundled with the browser.

Adrian Kingsley-Hughes

By for Hardware 2.0 |

Yesterday I reported that security firm VUPEN claimed to have a Google Chrome browser exploit that bypassed the browser's sandbox and Windows ASLR and DEP security measures. Today Google engineers are claiming that the bug isn't with Chrome itself but in the Flash player bundled with the browser.

Google security engineer Tavis Ormandy had this to say on Twitter:

"As usual, security journalists don't bother to fact check. VUPEN misunderstood how sandboxing worked in chrome, and only had a flash bug."

Side note: To be fair to security journalists, VUPEN doesn't given them much  to go on, and only discloses details of the vulnerability to government organisations and 'paying' customers.

Another Google security engineer, Chris Evans, chimed in with this in a reply to another comment on Twitter:

"It's a legit pwn, but if it requires Flash, it's not a Chrome pwn. Do Java bugs count as a Chrome pwn too, because we support NPAPI?"

VUPEN, while being open to questions, isn't answering questions related to the bug. VUPEN CEO Chaouki Bekrar became involved in the conversation with Google engineers on Twitter.

Judging by his responses, I think that it is fair to say that this is indeed a Flash bug and not  Chrome bug.

Topics: Browser, Security

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

75 comments
Log in or register to join the discussion

  • RE: Google engineers claim that Chrome PWN bug is a Flash bug

    Everyone told Google it was a bad idea to bundle Flash into Chrome. This is why.
    LoverockDavidson
    Reply Vote

    • Or are they just making excuses?

      @LoverockDavidson

      Again.
      John Zern
      Reply Vote

    • Gosh, I have to agree with Loverboy. It may be in Flash, but, Google must

      take responsibility for it since they ship Flash by default. They also need to take another look at the Flash sandbox techniques.
      DonnieBoy
      Reply Vote

      • Slip of the tongue ..

        @DonnieBoy [i]"...They also need to take another look at the Flash sandbox techniques."[/i]

        .. you mean [i]"Flash to trash can"[/i] techniques .. that's where it belongs.
        thx-1138_
        Reply Vote

      • RE: Google engineers claim that Chrome PWN bug is a Flash bug

        @thx-1138_@...

        Well, if that is the case then .pdf readers should go in the trash can, then word processing applications should go in the trash can, and Linux should go in the trash can..... GET REAL HERE!

        Just because something has vulnerabilities does NOT mean that it should automatically be dropped. Doesn't mean that even when the vulnerabilities come out over a period of years.
        Lerianis10
        Reply Vote

      • @Lerianis10 .. Nice try

        ... but i mean what i say and i say what i mean. No back-downs and no apologies.<br><br>So the one that needs to <i>"GET REAL HERE!"</i> is you, pal.
        thx-1138_
        Reply Vote

    • while clearly on Google's plate

      @LoverockDavidson

      Since they built the heralded sandbox - but still it's another example of why flash should be deemed a parasite and eradicated from the internet
      archangel9999
      Reply Vote

      • RE: Google engineers claim that Chrome PWN bug is a Flash bug

        @archangel9999
        Too bad there's not a tech company willing to take a stand and keep buggy/laggy/security risky flash off their platform. Wait...
        grayforge
        Reply Vote

      • RE: Google engineers claim that Chrome PWN bug is a Flash bug

        @grayforge

        Flash is no more buggy/laggy/security risky than Javascript and numerous other technologies used on the internet. The biggest problem is that Adobe has to keep backwards compatibility with OLDER versions of Flash, which is where part of the problems are coming from.
        Lerianis10
        Reply Vote

    • RE: Google engineers claim that Chrome PWN bug is a Flash bug

      @LoverockDavidson A lot of Flash exploits come from old versions of the Flash Player. The vast majority of web users have Flash installed, so it makes sense to bundle for browser vendors and include updates to protect the user. The small niche users who don't want Flash Player installed are likely tech savvy enough to remove it from Chrome themselves.
      Matt_Fabb@...
      Reply Vote

  • It is pathetic that Google is downplaying this...

    but this is nothing new.

    Google is a company that steals other people's idea but never admit their own failures. If they held themselves accountable once in a while maybe they'll actually produce a produce that works. Until then I guess it's more lip service from Google.
    iPad-awan
    Reply Vote

    • And yet one of the bloggers here tells us we should blindly trust Google

      @iPad-awan
      that they are the death of Microsoft and Apple.
      Tim Cook
      Reply Vote

    • RE: Google engineers claim that Chrome PWN bug is a Flash bug

      @iPad-awan
      ZDNet needs to wake up at some point and realize that the trolls outnumber the real posters here; realization is just the first step to cleaning up this mess of a forum, though.

      ZDNet needs to add features like comment history and personal blocklists. That might make this place bearable -- at least I could see that the last 20 comments from iPad-awan were total crap devoid of real information, and I could make a decision what to do with that..
      daengbo
      Reply Vote

      • That works both ways

        @daengbo
        And I won't have to read garbage from you and the rest of the fANDROID idiots.
        iPad-awan
        Reply Vote

      • RE: Google engineers claim that Chrome PWN bug is a Flash bug

        @daengbo

        I agree with iPad-awan, as his comment was very true. Google definitely has blame in this one (hello, failed sandboxing technology).

        Anyway, in terms of the comment system, ZDNet can/should implement Disqus (like Engadget), then you can look through peoples previous posts. :P (and also get alerts when you have replies, etc... )
        tk_77
        Reply Vote

      • ZDNets forum software is the worst I've ever used.

        @daengbo: It's sad that a technical site uses forum software which doesn't allow previews, doesn't provide a means to quote, doesn't throw posts into a black hole, doesn't mark a message as spam when it's edited, doesn't completely wipe out the subject when one attempts to edit it, provides a miniscule window to make comments, etc.

        Every other blog I participate on has forum software which provides these basic features. Whatever ZDNet is using here it's a complete joke.
        ye
        Reply Vote

      • ZDNet's forums are crap anyway...

        I'm ashamed I even come here to read comments anymore; the forum design is definitely down the toilet!
        JCitizen
        Reply Vote

  • RE: Google engineers claim that Chrome PWN bug is a Flash bug

    So it a flash exploit and Google chrome code live to survive a other day. An given the rumor I have read state that this took 6 months to developed and the most complicated hack they have ever done. I got the feeling by the time some evil hacker figures it out, Google and Adobe will have patch it up already.
    Knowles2
    Reply Vote

  • RE: Google engineers claim that Chrome PWN bug is a Flash bug

    I tend to agree with VUPEN ... IF it is included in the Google install bundle ... it is Google's baby.
    That said, I also don't think this is the end of the world.
    noagenda
    Reply Vote

  • RE: Google engineers claim that Chrome PWN bug is a Flash bug

    An people wonder why Apple keeps flash at a distance.
    dfl274
    Reply Vote
CNET Join | Log In | Privacy | Cookies Close