If Apple had already declared build 10A432 the GM before seeding it to developers for testing, that would be completely irresponsible (though sadly, not unprecedented). (Perhaps an email from Phil?) Snow Leopard build 10A432 was seeded to eligible ADC members on August 12. I’m not sure where Gruber gets the August 7 date. If these things do not occur privately, then both companies ought to be blamed for failing to follow industry best practices. One would presume that Adobe privately discloses security vulnerabilities in the OS X version of Flash Player to Apple in advance of public announcements and that Adobe privately provides Apple with versions of Flash Player to test on OS X prior to public release. Since Apple ships Adobe Flash Player with Mac OS X, Apple and Adobe undoubtedly have a private relationship. It is crucial to note that these were all public releases.
#ADOBE READER FOR MAC OS X VERSION 10.5.8 UPDATE#
We are in the process of developing a fix for the issue, and expect to provide an update for Flash Player v9 and v10 for Windows, Macintosh, and Linux by July 30, 2009″. There are reports that this vulnerability is being actively exploited in the wild via limited, targeted attacks against Adobe Reader v9 on Windows. This vulnerability (CVE-2009-1862) could cause a crash and potentially allow an attacker to take control of the affected system. On July 21, Adobe released a security bulletin to the public: “Adobe is aware of reports of a potential vulnerability in Adobe Reader and Acrobat 9.1.2 and Adobe Flash Player 9 and 10.” The next day, there was a public follow-up: “A critical vulnerability exists in the current versions of Flash Player (v9.0.159.0 and v10.0.22.87) for Windows, Macintosh and Linux operating systems, and the authplay.dll component that ships with Adobe Reader and Acrobat v9.x for Windows, Macintosh and UNIX operating systems. However, with regard to the version of Flash Player included with Snow Leopard, that date is largely irrelevant.
It is true that Adobe released Flash Player 10.0.32.18 to the public on July 30. Snow Leopard went GM on Friday August 7″. The essence of his absolution is the following timeline: “Adobe released version 10.0.32.18 of Flash on July 30. John Gruber holds Apple blameless for shipping Mac OS X 10.6.0 with an outdated version of Adobe Flash Player, a version with known vulnerabilities that have been exploited in the wild.
0 kommentar(er)
