Windows XP SP3 includes vulnerable Flash Player

Adobe recommendeds that all users update to version 9.0.124.0

Microsoft's Windows XP Service Pack 3 (SP3) ships with an out-of-date version of Adobe's Flash Player that's vulnerable to recently-spotted attacks, according to Microsoft's support documentation.

Windows XP SP3 includes Flash Player 9.0.115.0, a version released by Adobe Systems> in December 2007. That version of Flash Player, however, was superseded by version 9.0.124.0 on April 8, nearly two weeks before Microsoft decided SP3 was done by giving it a Release To Manufacturing (RTM) label and sending it out for distribution.

The older version that shipped with XP SP3, however, harbors a bug that hackers have been exploiting since last week; that's when security researchers, including those at Symantec, reported what they at first thought was a zero-day vulnerability in the most current edition of Flash, 9.0.124.0. A few days later, however, Symantec retracted that claim, and said that only the older 9.0.115.0 was at risk.

Adobe has confirmed that version 9.0.115.0, included with XP SP3, is vulnerable to the ongoing attacks, which have originated from Chinese servers. Users have been attacked after visiting legitimate Web sites that had been hacked using now-common SQL-injection attacks.

Microsoft noted that it bundled the outdated version of Flash Player with Windows XP in a document published on its support site; that document was last revised three weeks ago, on May 13. It has not advertised the fact, however, or issued a security advisory recommending that users update Flash.

Computerworld has confirmed that PCs running XP SP3 use the obsolete 9.0.115.0 version of Flash.

Adobe patched Flash on April 8 to plug seven vulnerabilities, including one that was reported two weeks earlier after a researcher used it to claim a US$5,000 prize in a hacking challenge.

Although Microsoft tagged Windows XP SP3 as RTM April 21, it didn't release the service pack into general distribution via Windows Update until May 6. It has not yet triggered the update service to automatically download and install the service pack to users who have that option turned on; instead, users must explicitly go Windows Update and select SP3 from a list of offered updates.

Late Monday, Microsoft declined to answer questions about Flash, including why it wasn't able to add the newest version to XP SP3 and what advice it would give users.

Users running XP SP3 can determine which version of Flash Player is installed by calling up this Adobe page in their browser. Adobe has recommended that all users update to version 9.0.124.0.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld

Comments

Comments are now closed.

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Shopping.com

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?