Chrome "0-day" exploited in the wild, what about the Dragon ?

[Czerno]

Google has disclosed high-severity vulnerabilty in Chrome, discovered by searchers from Kaspersky labs, and being actively exploited. As per :

Google Discloses Chrome Flaw Exploited in the Wild

…
Google is urging users to update to the latest version of Chrome, 78.0.3904.87.

Please confirm whether the current version of Comodo Dragon is affected/exploitable,
and in the plausible event it IS currently affected, when will either a fix or the new version be offered for download to CD users ? TIA !

[edited, to add:] I am not intending to be rude, understanding security is hard - but, security IS Comodo’s trade, also ! Realising this issue re. Google Chrome looks crucial, being exploited “in the wild”, please tell us ASAP either : CD 77.0.3865.120 (current UIAM) is NOT affected by the exploitable Chrome flaw, OR else, how soon do you estimate we’ll be offered the fix, available for Chrome, and either backported to CD 77.xxx or as an updated CD 78 ?

[Sergiu90]

@Czerno post:1

Google has disclosed high-severity vulnerabilty in Chrome, discovered by searchers from Kaspersky labs, and being actively exploited. As per :
https://threatpost.com/google-discloses-chrome-flaw-exploited-in-the-wild/149784/
…
Google is urging users to update to the latest version of Chrome, 78.0.3904.87.

Please confirm whether the current version of Comodo Dragon is affected/exploitable,
and in the plausible event it IS currently affected, when will either a fix or the new version be offered for download to CD users ? TIA !

[edited, to add:] I am not intending to be rude, understanding security is hard - but, security IS Comodo’s trade, also ! Realising this issue re. Google Chrome looks crucial, being exploited “in the wild”, please tell us ASAP either : CD 77.0.3865.120 (current UIAM) is NOT affected by the exploitable Chrome flaw, OR else, how soon do you estimate we’ll be offered the fix, available for Chrome, and either backported to CD 77.xxx or as an updated CD 78 ?

Hello Czerno, we are investigating the root of the problem, if this version of dragon contains the exploit we will release a new version as soon as posible

[Czerno]

@Sergiu90 post:2

Hello Czerno, we are investigating the root of the problem, if this version of dragon contains the exploit we will release a new version as soon as posible

Thank you, Sergiu ! In the meanwhile, are there known mitigations to the issue ? Should we stop using CD altogether ? Webpage hosting a (benign) demo of the exploit - or is this still embargoed ?

[catalin221]

@Czerno post:3

Thank you, Sergiu ! In the meanwhile, are there known mitigations to the issue ? Should we stop using CD altogether ? Webpage hosting a (benign) demo of the exploit - or is this still embargoed ?

Hello Czerno, the experts says that it can be triggered only if the users enter on certain websites that are specially crafted for this which means, “the average user shouldn’t lose any sleep”.Google did not make a disclosure yet. More info in the next few days. Thanks for the concern.

[Czerno]

@catalin221 post:4

Hello Czerno, the experts says that it can be triggered only if the users enter on certain websites that are specially crafted for this which means, “the average user shouldn’t lose any sleep”.Google did not make a disclosure yet. More info in the next few days.

Weeks later… no news ? How are we supposed to avoid those “certain sites”, specially crafted to exploit us? We can’t just ignore the threat and rely on mere luck, can we !

Google Chrome users are supposed to be protected. Please do the fix to Dragon ASAP, albeit just a beta release! I don’t know about Mr Average User, but this user is on the verge of loosing sleep while the menace is not addressed…

TY !

[Sergiu90]

@Czerno post:5

Weeks later… no news ? How are we supposed to avoid those “certain sites”, specially crafted to exploit us? We can’t just ignore the threat and rely on mere luck, can we !

Google Chrome users are supposed to be protected. Please do the fix to Dragon ASAP, albeit just a beta release! I don’t know about Mr Average User, but this user is on the verge of loosing sleep while the menace is not addressed…

TY !

Hello Czerno this issue has been addressed in the newest release(v77.0.3865.121), and your question has been answered by our Product Manager, Shane. The new beta version of Dragon will come shortly, it is currently under test

@Shane

The recently announced exploit, CVE-2019-13720, CVE - CVE-2019-13720 is currently of the status “** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.”

We’ve have merged the relevant change to mitigate CVE-2019-13720. Until the status changed and full details are disclosed we cannot 100% confirm the mitigation.

[Czerno]

@Sergiu90 post:6

This issue has been addressed in the newest release(v77.0.3865.121), and your question has been answered by our Product Manager, Shane.

Oh ! Good! Though I’d read Shane’s announcement about the issue, it hadn’t been clear (to me) that the mitigation was indeed included in the publicly released Dragon (.121).
… Now I sure will stop worrying about it!

The new beta version of Dragon will come shortly, it is currently under test

Thanks.