Microsoft speeds up IE10 Flash patching, matches Google
Out-of-nowhere update for Flash likely triggered by upcoming $2 million 'Pwnium' hacking contest that Google kicks off Wednesday, says expert
Computerworld - Adobe today issued a surprise update for Flash Player that patched 25 critical vulnerabilities in the ubiquitous media software.
The California company urged Windows users to apply the update in the next 72 hours after rating the fix as "Priority 1" in its three-step system. That ranking indicates "vulnerabilities being targeted, or which have a higher risk of being targeted, by exploit(s) in the wild."
Google released an update for the Windows version of Chrome, which includes Flash Player, at 10 a.m. PT.
And although Microsoft dated the Internet Explorer 10 (IE10) for Windows 8 update as Oct. 5 on its download website, on Monday a spokeswoman for the Redmond, Wash. developer said that the date was incorrect. Like Google, Microsoft began pushing the IE10 update via Windows Update today at approximately 10 a.m. PT.
Of the 25 vulnerabilities, 14 were classified as buffer overflow bugs, and the remaining 11 were characterized as memory corruption flaws. All could "lead to code execution," Adobe said in its Monday security advisory.
Microsoft's swift patching of IE10 on Windows 8 today was in contrast to last month, when the company first said it would not fix Flash flaws until late October. After being blasted for its laissez-fair attitude, Microsoft backtracked, saying it would issue an update. It did so on Sept. 21, when a company executive promised closer coordination with Adobe.
Microsoft, not Adobe, is responsible for patching Flash Player in Windows 8 because the former has mimicked Google's Chrome by building the software into IE10.
While Windows 8 has not officially launched -- the new OS goes on sale Oct. 26 -- developers, IT professionals and many enterprises have had access to Windows 8 since mid-August.
Andrew Storms, director of security operations with nCircle Security, saw Google's hand in the unexpected Flash update.
"This idea that Adobe would coordinate with Microsoft makes me ask why couldn't they have waited until tomorrow?" Storms asked, noting that Oct. 9 is Microsoft's already-scheduled Patch Tuesday. "There are no exploits in the wild, according to Adobe. But then I got wind of this whole Pwnium thing, so the stars pretty much align."
- Feds declare big win over Cryptolocker ransomware
- Hackers hit more businesses through remote access accounts
- P.F. Chang's post-breach move to manual processing is telling
- Microsoft withholds monster IE update from Windows 8.1 dawdlers
- In baffling move, TrueCrypt open-source crypto project shuts down
- 'Oleg Pliss' hack makes for a perfect teachable IT moment
- Give IE the heave-ho until Microsoft patches zero-day
- Hackers find first post-retirement Windows XP-related vulnerability
- Researcher claims two hacker gangs exploiting unpatched IE bug
- Update: Third of Internet Explorer users at risk from attacks
- Enable secure remote access to 3D data without sacrificing visual perfomance Design and manufacturing companies must adapt quickly to the demands of an increasingly global and competitive economy. To speed time to market for...
- Virtually Delivered High Performance 3D Graphics "A picture is worth a thousand words." That old phrase is as true today as it ever was. Pictures (i.e., those with heavy...
- Best Practices for Securing Hadoop Historically, Apache Hadoop has provided limited security capabilities. To protect sensitive data being stored and analyzed in Hadoop, security architects should use a...
- Top Tips for Securing Big Data Environments: Why Big Data Doesn't Have to Mean Big Security Challenges Organizations must come to terms with the security challenges they introduce. As big data environments ingest more data, organizations will face significant risks...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!