site Search:


 
    All Forums Hot Topics Gallery






how-to block ads


 
Search Topic:
Uniqs:
1271
Share Topic
Posting?
Post a:
Post a:
AuthorAll Replies

tdagg

join:2001-03-02
Concord, NH

Wacom Bamboo Pen & Touch has vulnerable Adobe software incld

... and when I emailed them asking what they (& Adobe?) plan to do about it they sent me back* a quote from their Terms of Service basically saying they have no responsibility to do ANYTHING about it.. They basically said 'Go talk to Adobe..'.

Now a little background: This is the second Wacom graphics tablet I've bought from them(I really like their products!). Both came with a copy of Adobe Photoshop Elements on one of the CDs in the package.
All my customer support communication was polite and provided all M/N and S/N including Adobe software S/N.

I also included a link to the "Security Advisory for Adobe Photoshop Elements 8" (Here's the text from the advisory):
--------------------------------------------
Release date: September 30, 2011

Vulnerability identifier: APSA11-03

CVE number: CVE-2011-2443

Platform: Windows

Summary-
Critical vulnerabilities exist in Adobe Photoshop Elements 8.0 and earlier versions. These vulnerabilities (CVE-2011-2443) could cause a crash and potentially allow an attacker to take control of the affected system. An attacker would need to convince a user to open a malicious binary .grd or .abr file to successfully exploit the issue. Adobe is not aware of any attacks exploiting these vulnerabilities against Adobe Photoshop Elements to date. Photoshop Elements 10 and Photoshop Elements 9 are not vulnerable to this issue.

Affected software versions-
Adobe Photoshop Elements 8.0 and earlier versions for Windows

Solution-
Because Photoshop Elements 8 is no longer supported, Adobe recommends users upgrade to Photoshop Elements 10. Users who cannot upgrade to Photoshop Elements 10 should not open .grd or .abr files from untrusted sources.

Severity rating-
Adobe categorizes this as a critical issue.

Details-
Critical vulnerabilities exist in Adobe Photoshop Elements 8.0 and earlier versions. These two buffer overflow vulnerabilities (CVE-2011-2443) could cause a crash and potentially allow an attacker to take control of the affected system. An attacker would need to convince a user to open a malicious binary .grd or .abr file to successfully exploit the issue. Adobe is not aware of any attacks exploiting these vulnerabilities against Adobe Photoshop Elements to date. Photoshop Elements 10 and Photoshop Elements 9 are not vulnerable to this issue. Because Adobe Photoshop 8 and earlier versions are no longer supported, Adobe recommends users upgrade to Photoshop Elements 10 or Photoshop Elements 9.
------------------------------- end of advisory
[Advisory pg URL]: »www.adobe.com/support/security/a···-03.html
------------------------------------------------------------------

Bottom line..

- Wacom sells tablets with Adobe Photoshop Elements 8.0 included in the package and advertises the software on the package.

- Wacom has tablets on store shelves now (I checked locally at the time I contacted them) that include software containing a "Critical" vulnerability.

- There no warning to customers of this fact.

- There was no warning to *users* (like me) who subscribe to their [News?]letter.

- Evidently (from the response* I got from Wacom) they don't plan to do anything about it.
Also it's evident (from the response) that the Adobe advisory wasn't read because in the response they wrote "All I can say to you is that Adobe is the company that will address those issues in their software updates for you and not Wacom.". No, Adobe clearly states that they WON'T "[...] address those issues [...]".

To me this is a totally irresponsible reaction (and 'non-reaction' in a sense) by a major company from a security standpoint.
From a customer relations standpoint it says (to me) that the company doesn't even care enough about it's customers to alert them to a "critical" vulnerability that (in their case) was the result of purchasing a Wacom product and installing software included with that product.
And if that wasn't irresponsible enough, all affected products currently in stores and warehouses will [apparently] be sold with no warning to the buyer. - WOW (Shouldn't that violate some law?)

I hope they reconsider and address this issue like a responsible company should.
-------------------
- I hope others will help spread the word about this to the tech community at large (Graphics/Security/Business/Law). This isn't simply my problem, the security implications alone effect users worldwide.
- & Please, I suggest that any communication with Wacom (or Adobe) be polite!

- Thanks

------------------------------------
*(THIS is the email response I got):

Oct 13 (2 days ago)

I hear you Thomas. All I can say to you is that Adobe is the company that will address those issues in their software updates for you and not Wacom.

Wacom’s statement regarding “All Software” is:

Software is licensed "as is." Wacom makes no warranty with respects to its quality or performance. Wacom cannot guarantee you uninterrupted service or the correction of any errors. »www.wacom.com/en/Store/Navigatio···nty.aspx

Have a great rest of the week,

Henry Reed
Customer Care
Wacom Technology Services Corp.
P: 800-922-6613
H: 7:30am-5:00pm M-Th (PST)
8:30am-5pm Friday (PST)
www.wacom.com/index2.php


lugnut

@look.ca

So let me get this straight? Wacom bundles a $3 OEM copy of obsolete third party software with their tablets and you get bent out of shape because THEY won't support the third party program?

What they essentially told you is correct, it's Adobe's problem not theirs and since you didn't buy the software directly from Adobe they were also essentially correct in telling you to go pound sand. That's what people get when they install and click on EULAs without reading or caring what's in them.

Your beef is not with Wacom or Adobe specifically but rather the entire commercial software industry as it stands and has stood for the last 30 years. I have NEVER in the last 30 years seen any EULA guaranteeing usability or fitness of an application to actually perform up to anybody's expectations. It's always more or less caveat emptor when it comes to those sleazy weasel words you have to click on. Pretty much once you break the shrink wrap you're stuck up the creek without any options.

Don't wanna knuckle under to their terms? Then go open source, That's your only real alternative.


Babuloseo

join:2010-03-13
Brampton, ON

reply to tdagg
open source is really the way to go now. Look at some projects like MyPaint, Blender,GIMP/GIMPpainter,Inkscape, Aclehmy, and etc.

Trust me, you dont really need photoshop. I like to use them all really.
Know what software you are using, but free and open source software is great.


tdagg

join:2001-03-02
Concord, NH

reply to lugnut
lugnut, First thanks for your reply, but I think you missed my point somewhat (see FYI-2 at the bottom), and maybe *I* let my idealism overflow a little (I don't think so, but you might).

--------------------
Note: I'm going to reiterate many of the same points in my original post and hopefully clarify it a bit. But I do tend to run on when I care about a subject.. (I really need a personal editor).
-------------------

I'm a cynic, but I've learned that sometimes companies can react to sudden, unpleasant issues (like this one) with maturity and responsibility that generates respect and increased customer loyalty. That should be encouraged and applauded.

When companies include 3rd-party software with their products (especially physical CDs) they have to consider certain things.

- What they will do in the event of a vulnerability being discovered?
and/or
- What will they do over time as the software ages?

If the software was an old[er] unsupported version to begin with it's certainly not going to be the responsibility of the 3rd-party software company to alert Wacom's customers.

So, do you just plan to say/do nothing (leaving your customers who don't pay attention to the myriad of security newsletters, or scan their systems for outdated/affected software, vulnerable), hiding behind your EULA?

Well, if your company leaders simply listen to their legal advisers and shareholders, and ignore Customer Relations, for Wacom it appears that the answer is yes.

That reaction comes with a price however. It will undoubtedly result in fewer repeat customers (like I *was*) and fewer potential first time sales because of negative 'word-of-mouth'.
Though sadly, as a security evangelist I know all too well that so many current & future purchasers won't even be aware (blissfully dangerous?) that there's a vulnerability alert for Adobe Photoshop Essentials 8.0..

It's a question of a company's character and responsibility to it's customers.

It's also a matter of overall security "responsibility", not just to Wacom's customers but also to the others that could be affected/infected.

Are you saying that you don't think Wacom has any responsibility to alert it's affected customers of this "Critical" vulnerability?
[I] sure do!

What about someone [now] buying a Wacom product with this vulnerable software in the box?
[I] think they should be provided with that knowledge.
[I] think *not* alerting them is negligent and dangerous!

[I] think Wacom should act responsibly and *at the very least* notify current & future customers of this security vulnerability.

Going forward, they can't continue selling tablets with the version 8.0 of Adobe Photoshop Essentials included.

Remember, this isn't new.. Companies have been including 3rd-party software on CDs with products for years. Eventually things like this security issue come up, or the software versions age/progress to the point where they update the version provided to companies that they partner with, or they end the partnership.

Adobe has done their part at this point. They posted a vulnerability alert, and noted that the versions that this vulnerability affects are no longer supported and won't be patched.
And for Wacom to say to me "... Adobe is the company that will address those issues in their software updates for you and not Wacom.", I think to myself.. 'What part of Adobe's statement of "Because Adobe Photoshop 8 and earlier versions are no longer supported,..." doesn't Wacom understand?'.

[I] would *like* to see Wacom and Adobe negotiate a deal for a newer (non-vulnerable) version and eventually replace their affected customers software. If they act responsibly and show that they care about the people who read their sales points and bought their product, rather than lose customers they will GAIN them.

Does a company that wants to grow simply care about the first sale? NO.. They want the customer to come back, over and over again. You won't get far if you're only thinking short-term.

I'm NOT asking too much here.. and it's just good business sense!

I see it over and over.. Politicians, governments, celebrities, and companies so often make their first reaction to an 'unpleasant situation'/crisis silence and denial instead of doing what most crisis management experts advise, which is being upfront and open from the start. It earns respect rather than contempt.
BTW, I have personal experience in this area and learned long ago that being upfront & honest is the way to go.
-----------------------------
FYI:
1. I'm one of the few that ALWAYS reads the TOC/EULA/Privacy in FULL and saves them in EULAlyzer. I agree with you regarding EULAs. Almost all come down to 'We aren't promising you anything, and even if we/our product messes up we aren't liable (unless the state/territory you reside in has a specific protections regarding this issue)'.
2. Adobe Photoshop Essentials isn't my primary graphics software, and in regards to open source options I AGREE and have good number of open source apps running on my computer. - So *my* use of Adobe Photoshop Essentials 8.0 isn't really the issue..



lugnut

@look.ca

tdagg

Regardless of whether or not the American courts have mandated that corporations are people too, nobody has ever mandated that they have to have a conscience. The fact of the matter is that 99% of corporations supply the absolute minimum required to get the job done with maximum profit and minimum liability to themselves.

Sure there are "green corporations" and "eco-friendly corporations" and even "ethical corporations" out there but they are very much the minority in the mix and the biggest success stories out there ( like for instance a corporation that rhymes with "Schmallmart" ) have trimmed their ethical footprints to the barest nub.

Frankly you are barking up an idealistic tree in the middle of a forest of Bernie Madoffs and Goldman Sachs that is corporate America today.

Posting a rant on an obscure forum that averages a post every two days or so may provide you with some warm and fuzzy feeling that you are "doing your bit" but I think if you really want to see change you'd be better off occupying Wall Street than trying to start a grassroots movement to change the way that the software industry does business.

Hell on any given day any version of Windows contains a few hundred unaddressed documented security holes which Microsoft views as unnecessary to fix. Let's face it. M$ pretty much invented the EULA as we know it today and everyone else picked it up along the way and ran with it like thieves in the night.

You might be better off addressing your critical emails to Steve Ballmer rather than to anyone at Adobe or Wacom if you really hope to see any results.

As for software vulnerability? Nowadays even Linux is falling victim to malware attacks. Anyone who buys a computer these days should be warned he is participating in a Roshambo Competition without a jockstrap but the reality is that the entire industry suffers from fatal security flaws which even the Pentagon and Sony corporation have proven themselves unable to defend themselves against.

You want to change the world? It's an admirable goal. The rest of us have tilted at enough windmills in our foolish youth to have learned the ways of the world and keep our heads down when the sh*t hits the fan


tdagg

join:2001-03-02
Concord, NH

Well lugnut thanks for you opinion. That's one.. As for the choice of forum, I asked site mods for advice before I posted.

I'm going to leave it there


Friday, 01-Jun 22:37:03 Terms of Use & Privacy | feedback | contact | Hosting by nac.net - DSL,Hosting & Co-lo
over 12.5 years online © 1999-2012 dslreports.com.
Most commented news this week
Hot Topics