Windows XP SP3 includes vulnerable Flash Player

[Michael]

Hello all,

Important info for admins deploying XP SP3:

Microsoft Corp.'s Windows XP Service Pack 3 (SP3) ships with an out-of-date version of Adobe's Flash Player that's vulnerable to recently-spotted attacks, according to Microsoft's support documentation. Windows XP SP3 includes Flash Player 9.0.115.0, a version released by Adobe Systems Inc. in December 2007. That version of Flash Player, however, was superseded by version 9.0.124.0 on April 8, nearly two weeks before Microsoft decided SP3 was done by giving it a Release To Manufacturing (RTM) label and sending it out for distribution.

More info here

Check what version you're running here You should be running 9.0.124.0 to be safe

If you're looking to install/deploy Flash 9.0.124.0 you can read an article I've created here

[Geoff]

Presumably MS is going to push an update via Windows Update/WSUS for this?

[Michael]

Presumably MS is going to push an update via Windows Update/WSUS for this?

I'm not so sure about this, but it's just as easy to get the official Adobe Flash MSI and deploy to the network.

I alsways found it odd that if you do a fresh build, install SP3 and then go to Windows updates, it still needs an update to Windows Installer before it continues.

I noticed this too, but it was very recent. I've been running XP SP3 at home for a few weeks and within the last few days it prompted me to update the Windows Installer. It's only a few hundred KB in size, so it's not really a problem

[Ste_Harve]

I've noticed that machines with SP3 on are a lot more unstable in internet explorer with it crashing at least once first time you open it up. Only seems to happen on certain sites. Main one being Welcome to The Lancashire Grid for Learning Website could this be related to this flash problem?

[Michael]

I've not had any problems with IE7 and SP3 on any sites. As far as I can tell, there is no Flash on the LGFL website (on the homepage anyway).

It is recommended you run the latest versions of Flash, Shockwave and Java, not only for compatibility in general, but of course security is maintained too.

[cookie_monster]

Flash Player 9.0.115.0 also has some annoying bugs that broke a few apps, one was e-science but there were many others apparently, this was fixed in the next version.