News for hackers. Stuff that matters.

A comment on AVG: “Web TuneUP” extension multiple critical vulnerabilities. Parent comment

Re:AVG: “Web TuneUP” extension multiple critical vulnerabili... by pilif on Monday December 28, 2015 @06:50PM (#10804211)
If you check the linked page, you'll see that it has been fixed and only then the bug was opened to the public
[ Parent | on HN ]
Re:AVG: “Web TuneUP” extension multiple critical vulnerabili... by ikeboy on Monday December 28, 2015 @06:57PM (#10804243)
As far as I can tell, only the first issue was fixed. Is the XSS issue fixed as well? There doesn't seem to be any acknowledgement of a fix on the page after that's mentioned.

And loading http://webtuneup.avg.com/static/dist/app/4.0.5.0/interstitia... still shows an alert, the issue has not been fixed.

[ Parent | on HN ]
Re:AVG: “Web TuneUP” extension multiple critical vulnerabili... by brazzledazzle on Monday December 28, 2015 @08:29PM (#10804596)
Perhaps the employee considers the reported vulnerability in the extension resolved and the XSS issue was just a side note. I'm sure a lawyer could argue that Google is in full compliance with its policies which are probably noted in a EULA and T&C as being subject to the discretion of Google employees.

Ostensibly the 90-day window is to protect everyone, not protect companies. It gives them time to develop and test a patch which is good for all users of the software. It's not to give a company mishandling security more time to be idiots. Especially a security company. Better that users get the information to act on immediately.

[ Parent | on HN ]