Busy patch tuesday ahead
Come Tuesday, Adobe is apparently planning to issue critical updates for Adobe Reader. Microsoft's advance notification indicates that we'll be getting a plethora of patches, most prominently a critical one ("remote code execution") for Internet Explorer. Further, Firefox 3.6.14 is also tentatively scheduled for a release on same Tuesday. Looks like we're in for a busy patch week.
Oh, just click "yes"
Java and Java Applets are featuring prominently on my "annoyances list" this year. There are vulnerabilities aplenty, and incompatibilities keep many a firm or university from applying the patches. We've covered these to some extent.
The latest incarnation of annoyance though is commercial software applets that are signed with an expired certificate. Dear vendors, if your "release" is supported until 2013, it is a bad idea to sign the code of said release with a cert that expires in December 2010. And it is an even worse idea to suggest to clients who open a ticket that they should just tell their users to "click yes" on the certificate warning until a patch can be provided.
The Original Sin of certificate handling in Java and Web Browsers alike?
The "oh, connect anyway" button.
I sure wish it simply weren't there.
Comments