5

Has anyone seen a response from SalesForce yet around the recent "Meltdown, Spectre".

The severe design flaw in Intel microprocessors that allows sensitive data, such as passwords and crypto-keys, to be stolen from memory is real – and its details have been revealed.

Media Source

I know this has only just been published in the last few hours, but Microsoft, Amazon and Google have all released responses and have not seen anything from SalesForce yet.

  • 5
    Take some comfort from the reality that both the vulnerability and code that exploits the vulnerability need to be present for there to be a problem. At least in the core platform, an executable that directly manipulates memory (to exploit the vulnerability) can't be added AFAIK. – Keith C Jan 4 '18 at 12:00
4

A colleague forwarded this Knowledge Article 000269171 that talks about this vulnerability (content copied to here 5 Jan 2018):

Description

The Salesforce Security team continuously monitors our systems for any evidence of attempts to exploit vulnerabilities to exploits such as 'Spectre' and 'Meltdown.'

At this time we have seen no indications of attempts to target Salesforce systems using these vulnerabilities.

Resolution

Salesforce response to 'Spectre' and 'Meltdown' Vulnerabilities

  • Salesforce is aware of recently reported security vulnerabilities 'Spectre' and "Meltdown,' which are affecting a wide range of computer processors.
  • As is the case for many other companies, Salesforce’s infrastructure uses operating systems that are impacted by these vulnerabilities.
  • Salesforce is working to remediate these vulnerabilities as quickly as possible as the applicable patches are made available by our vendors.
  • Salesforce will continue to monitor the issue and provide updates as appropriate.
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.