September 08, 2012, 10:18 AM — Microsoft's Windows 8 is vulnerable to attack by exploits that hackers have been aiming at PCs for several weeks, Adobe confirmed Friday.
Microsoft said it will not patch the bug in Flash Player until what it called "GA," for "general availability." That would be Oct. 26, when Windows 8 hits retail and PCs powered by the new operating system go on sale.
"We will update Flash in Windows 8 via Windows Update as needed," a spokeswoman said in a reply to questions. "The current version of Flash in the Windows 8 RTM build does not have the latest fix, but we will have a security update coming through Windows Update in the GA timeframe."
Microsoft, not Adobe, is responsible for patching Flash Player in Windows 8 because the company took a page from Google's playbook and integrated the popular media software with Internet Explorer 10 (IE10), the new operating system's browser. Microsoft announced that move in late May when it launched the last public sneak-peak of Windows 8, or "Release Preview."
At the time, Dean Hachamovitch, the company's lead executive for IE, said, "By updating Flash through Windows Update, like IE, we make security more convenient for customers."
Chrome was the first -- and until Microsoft's move, the only -- browser maker to integrate Flash Player rather than rely on an external plug-in. Google has been providing updated versions of Flash Player with Chrome for more than two years, and usually refreshes its browser with Flash patches the same day that Adobe issues them to the public. In some instances, Google has actually beaten Adobe to the patch punch.
Not so with Microsoft in the case of Windows 8 RTM, or "release to manufacturing," the Aug. 1 milestone that gave the go-ahead for computer makers to start preparing new PCs and for some customers to download, install and start using the upgrade.
Last month, Adobe issued two updates for Flash Player that patched eight vulnerabilities, some of which were ranked as "1" by the company, its highest threat warning. One of the vulnerabilities, tagged as CVE-2012-1535, was patched Aug. 14, but had been exploited for an indeterminate time before that.
In fact, CVE-2012-1535 was one of four "zero-days," or unpatched vulnerabilities, exploited in a 16-week stretch by an elite hacker gang revealed by Symantec researchers on Friday.