Windows XP SP3 includes vulnerable Flash Player

Adobe recommendeds that all users update to version 9.0.124.0

Microsoft's Windows XP Service Pack 3 (SP3) ships with an out-of-date version of Adobe's Flash Player that's vulnerable to recently-spotted attacks, according to Microsoft's support documentation.

Windows XP SP3 includes Flash Player 9.0.115.0, a version released by Adobe Systems> in December 2007. That version of Flash Player, however, was superseded by version 9.0.124.0 on April 8, nearly two weeks before Microsoft decided SP3 was done by giving it a Release To Manufacturing (RTM) label and sending it out for distribution.

The older version that shipped with XP SP3, however, harbors a bug that hackers have been exploiting since last week; that's when security researchers, including those at Symantec, reported what they at first thought was a zero-day vulnerability in the most current edition of Flash, 9.0.124.0. A few days later, however, Symantec retracted that claim, and said that only the older 9.0.115.0 was at risk.

Adobe has confirmed that version 9.0.115.0, included with XP SP3, is vulnerable to the ongoing attacks, which have originated from Chinese servers. Users have been attacked after visiting legitimate Web sites that had been hacked using now-common SQL-injection attacks.

Microsoft noted that it bundled the outdated version of Flash Player with Windows XP in a document published on its support site; that document was last revised three weeks ago, on May 13. It has not advertised the fact, however, or issued a security advisory recommending that users update Flash.

Computerworld has confirmed that PCs running XP SP3 use the obsolete 9.0.115.0 version of Flash.

Adobe patched Flash on April 8 to plug seven vulnerabilities, including one that was reported two weeks earlier after a researcher used it to claim a US$5,000 prize in a hacking challenge.

Although Microsoft tagged Windows XP SP3 as RTM April 21, it didn't release the service pack into general distribution via Windows Update until May 6. It has not yet triggered the update service to automatically download and install the service pack to users who have that option turned on; instead, users must explicitly go Windows Update and select SP3 from a list of offered updates.

Late Monday, Microsoft declined to answer questions about Flash, including why it wasn't able to add the newest version to XP SP3 and what advice it would give users.

Users running XP SP3 can determine which version of Flash Player is installed by calling up this Adobe page in their browser. Adobe has recommended that all users update to version 9.0.124.0.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Gregg Keizer

Gregg Keizer

Computerworld
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?