Amid concerns that users of its Window XP Service Pack 3 operating system may be vulnerable to online attacks, Microsoft has finally broken its silence and explained which XP users need to upgrade their Adobe Flash Player software.
The confusion started Monday, when handlers at the Internet Storm Center pointed out that Microsoft had quietly noted that the recent XP SP 3 was vulnerable to five Flash bugs patched in November 2006. Some took this to mean that if an XP system was updated to Service Pack 3, it would somehow wind up with an older, buggy, version of the Flash Player.
Microsoft originally declined to comment on the matter, but on Tuesday it reconsidered and said that this is not the case.
“Microsoft does not ship any version of Flash in the Windows XP Service Pack 3 update that customers use to update existing SP2 machines,” the company said in a statement.
However some people who build new XP systems using SP3 will need to update their software. "A new system built using a copy of Windows XP with SP3 integrated will install the original Flash 6 that shipped with Windows XP Gold and will need MS06-069 installed from Windows Update," Microsoft said.
They should, however, be running the latest version of the player, 18.104.22.168, which includes bug fixes that protect against an attack currently being used by criminals.