ec:
> if you had a vulnerability that allowed remote execution and required an action
> that requires superuser access on an unrooted device, the vulnerability
> would be useless for someone who wanted to attack an unrooted device.
1. I do not believe that that is true. Just like on a Windows computer, the attack would be limited when operating in a limited user account, but it would _not be eliminated_.
It would have access to all files and privileges that the limited user account has access to. Which is a lot.
I wouldn't be real happy if it stole my contacts list (including their email addresses, for spamming purposes) or deleted my several GB of music files. Or deleted my apps. Or placed calls where charges would occur (e.g., foreign countries, 900 numbers, etc).
2. From reading their security warning, it appears that Adobe doesn't believe that "the vulnerability would be useless for someone who wanted to attack an unrooted device" either.
Perhaps you are saying that after gaining access, the hacker would need to tailor the attack specifically for Android OS, as opposed to Windows.
The hacker's response would be: no problem.
They can do that any time they want to.
Look at it this way, Erik.
All this just sells more NMS.
Hopefully NMS protects against these kind of vunerabilities (e.g., flash).
Does it?
