Windows XP SP3 includes vulnerable Flash Player
Microsoft Corp.'s Windows
XP Service Pack 3 (SP3) ships with an out-of-date version of Adobe's
Flash Player that's vulnerable to recently-spotted attacks, according to
Microsoft's support documentation.
Windows XP SP3 includes Flash Player 9.0.115.0, a version released by Adobe
Systems Inc. in December
2007. That version of Flash Player, however, was superseded by version 9.0.124.0
on April 8, nearly two weeks before Microsoft decided SP3 was done by giving
it a Release To Manufacturing (RTM) label and sending it out for distribution.
The older version that shipped with XP SP3, however, harbors a bug that hackers
have been exploiting since last week; that's when security researchers, including
those at Symantec
Corp., reported what they at first thought was a zero-day vulnerability
in the most current edition of Flash, 9.0.124.0. A few days later, however,
Symantec retracted that claim, and said that only
the older 9.0.115.0 was at risk.
Adobe has confirmed that version 9.0.115.0, included with XP SP3, is vulnerable
to the ongoing attacks, which have originated from Chinese servers. Users have
been attacked after visiting legitimate Web sites that had been hacked using
now-common SQL-injection attacks.
Microsoft noted that it bundled the outdated version of Flash Player with Windows
XP in a document
published on its support site; that document was last revised three weeks
ago, on May 13. It has not advertised the fact, however, or issued a security
advisory recommending that users update Flash.
Computerworld has confirmed that PCs running XP SP3 use the obsolete 9.0.115.0
version of Flash.
Adobe patched Flash on April 8 to plug
seven vulnerabilities, including one that was reported two weeks earlier
after a researcher used it to claim a $5,000 prize in a hacking challenge.
Although Microsoft tagged Windows XP SP3 as RTM April 21, it didn't release
the service pack into general distribution via Windows Update until May 6. It
has not yet triggered the update service to automatically download and install
the service pack to users who have that option turned on; instead, users must
explicitly go Windows Update and select SP3 from a list of offered updates.
Late Monday, Microsoft declined to answer questions about Flash, including
why it wasn't able to add the newest version to XP SP3 and what advice it would
give users.
Users running XP SP3 can determine which version of Flash Player is installed
by calling up this
Adobe page in their browser. Adobe has recommended that all users update
to version 9.0.124.0.
» posted by abennett
Computerworld
Build your tech library with our book giveaways.
Windows PowerShell 2.0 Unleashed
By Tyson Kopczynski, Pete Handley, Marco Shaw; Published by Sams
Windows PowerShell Unleashed will not only give you deep mastery over PowerShell but also a greater understanding of the features being introduced in PowerShell 2.0–and show you how to use it to solve your challenges in your production environment. Enter now!
Ubuntu Server Administration
By Michael Jang; Published by McGraw-Hill Osborne Media
Realize a dynamic, stable, and secure Ubuntu Server environment with expert guidance, tips, and techniques from a Linux professional. Ubuntu Server Administration covers every facet of system management -- from users and file systems to performance tuning and troubleshooting. Enter now!
