The odd saga of CVE-2012-5639 [LWN.net]

The odd saga of CVE-2012-5639

Posted Jan 11, 2024 13:49 UTC (Thu) by farnz (subscriber, #17727)
In reply to: The odd saga of CVE-2012-5639 by Wol
Parent article: The odd saga of CVE-2012-5639

It's also extremely unusual for someone's job to rely on opening documents that access arbitrary external content. More commonly, if you need to access external content, it comes from a limited set of sources; for example, you might need to access content stored on your company's managed systems, but not arbitrary Internet content. This implies that, assuming you have a competent and well-run IT department, an allowlist of sources of external content, where sources not on the allowlist are blocked completely, would be sufficient to protect users and wouldn't affect people's ability to do their jobs.

Of course, as with anything else, the hard part is making sure that the assumption is true. It's all too common for IT departments to be a mixture of incompetent and badly run, such that there's no way to handle exceptional cases or change to the norm in a speedy but safe fashion.

to post comments

The odd saga of CVE-2012-5639

Posted Jan 11, 2024 14:10 UTC (Thu) by smurf (subscriber, #17840) [Link] (1 responses)

Personally I could care less about badly-run IT departments. I care about "default-secure", which (a) doesn't even need an IT department and (b) negates quite a few opportunities for incompetence.

On the other hand, a "run in secure mode" button that's hidden three layers deep in some option dialog, defaults to Off, and doesn't allow for a whitelist, is (in some sense) even worse than not having the option at all.

The odd saga of CVE-2012-5639

Posted Jan 12, 2024 2:37 UTC (Fri) by NYKevin (subscriber, #129325) [Link]

> Personally I could care less about badly-run IT departments. I care about "default-secure", which (a) doesn't even need an IT department and (b) negates quite a few opportunities for incompetence.

The problem is that there's no obvious attack which can meaningfully be carried out against a user who doesn't work for some organization with an IT department,* but would be prevented by blocking external content. Sure, there are tracking pixels, but think about it: From the user's perspective, what is the negative consequence caused by a tracking pixel? The sender gets a read receipt? That's hardly worth discussing, by the time you have convinced a user to download and open an attachment. Heck, you could just put the document on your own server and tell the user to click a link to download it, then you don't even need the user to open the document. Do you really think the average non-technical user is going to notice the difference between clicking a link to download something and downloading an attachment?

* The military, the NSA, etc. are all assumed to have IT departments, so we need not concern ourselves with the "my workstation is airgapped and all the ports are filled with epoxy" stuff. Even so, that seems like a problem that solves itself ("airgapped" means no external content will load).