New answers tagged

0

Getting a CVE and "releasing it" doesn't mean exploitation will happen, they'd also have to release details on the vulnerability. Also it is less then ideal to go "CVE shopping" when one CNA isn't playing nice, if that occurs please go directly to Mitre, cve-assign@mitre.org and notify them so they can poke the CNA and if no movement then hopefully Mitre ...


0

I would not say that I am an expert in this so my point may not be valid. I quickly readed on Wikipedia On modern mobile devices such as smartphones, an over-the-air update may refer simply to a software update that is distributed over Wi-Fi or mobile broadband using a function built into the operating system From this quote we may note that the ...


4

However, for security patches, wouldn't a staggered release make it much easier for blackhat hackers to utilize the now-public vulnerabilities against users whose devices have not yet received the OTA, even though a patch for their device model is already available? Easier than what?, is the important question. Yes it will be easier for the hacker ...


54

Excellent question. Yes, your understanding is correct, as well as your rationale behind it. Staggering roll outs for new features often makes good sense. Staggering roll outs for security patches rarely is a good idea. As you pointed out, this gives even more opportunity for the vulnerabilities to be exploited. Perhaps even more importantly, the ...


2

As requested, I'm making this an answer: You could either contact your countries CERT contact the CERT of the manufacturer's country. Hopefully, they will forward the information appropriately.



Top 50 recent answers are included