Microsoft speeds up IE10 Flash patching, matches Google

Out-of-nowhere update for Flash likely triggered by upcoming $2 million 'Pwnium' hacking contest that Google kicks off Wednesday, says expert

Adobe today issued a surprise update for Flash Player that patched 25 critical vulnerabilities in the ubiquitous media software.

The California company urged Windows users to apply the update in the next 72 hours after rating the fix as "Priority 1" in its three-step system. That ranking indicates "vulnerabilities being targeted, or which have a higher risk of being targeted, by exploit(s) in the wild."

Google released an update for the Windows version of Chrome, which includes Flash Player, at 10 a.m. PT.

And although Microsoft dated the Internet Explorer 10 (IE10) for Windows 8 update as Oct. 5 on its download website, on Monday a spokeswoman for the Redmond, Wash. developer said that the date was incorrect. Like Google, Microsoft began pushing the IE10 update via Windows Update today at approximately 10 a.m. PT.

Of the 25 vulnerabilities, 14 were classified as buffer overflow bugs, and the remaining 11 were characterized as memory corruption flaws. All could "lead to code execution," Adobe said in its Monday security advisory.

Microsoft's swift patching of IE10 on Windows 8 today was in contrast to last month, when the company first said it would not fix Flash flaws until late October. After being blasted for its laissez-fair attitude, Microsoft backtracked, saying it would issue an update. It did so on Sept. 21, when a company executive promised closer coordination with Adobe.

Microsoft, not Adobe, is responsible for patching Flash Player in Windows 8 because the former has mimicked Google's Chrome by building the software into IE10.

While Windows 8 has not officially launched -- the new OS goes on sale Oct. 26 -- developers, IT professionals and many enterprises have had access to Windows 8 since mid-August.

Andrew Storms, director of security operations with nCircle Security, saw Google's hand in the unexpected Flash update.

"This idea that Adobe would coordinate with Microsoft makes me ask why couldn't they have waited until tomorrow?" Storms asked, noting that Oct. 9 is Microsoft's already-scheduled Patch Tuesday. "There are no exploits in the wild, according to Adobe. But then I got wind of this whole Pwnium thing, so the stars pretty much align."

Under Storms' theory, Adobe felt obliged to ship the Flash update today because Google will kick off a second hacking contest -- dubbed "Pwnium 2" -- in Kuala Lumpur, Malaysia, on Wednesday.

Google security engineers reported 24 of the 25 vulnerabilities to Adobe, most likely to harden Chrome against hackers' attacks at the contest.

When Google announced Pwnium 2 in August, it said it would set aside as much as $2 million in prize money, to be paid out in increments of $60,000, $50,000 and $40,000 to researchers able to exploit bugs in Chrome, in Chrome and other software, or in non-Google code.

The continued abruptness of Flash updates left a sour taste in Storms' mouth.

"These half-policies and half-practices cause confusion," Storms argued. "They're disjointed. When [the Flash Player] update appeared today, I thought, 'It must be a zero-day' because there was no warning."

Adobe said that it was not aware of any in-the-wild exploits now leveraging the vulnerabilities patched today.

"Ordinarily, it would have been fine to wait to patch this until tomorrow," said Storms, again referring to Microsoft's Patch Tuesday. "It probably would have happened tomorrow, but Google forced the hand of Adobe." Windows 8 users can obtain today's Flash update for IE10 via the Windows Update service, as well as through the enterprise-grade WSUS (Windows Server Update Services).

So far this year, Adobe has issued eight Flash updates: One in February; two in March; one each in May and June; two in August; and one in October.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, or subscribe to Gregg's RSS feed . His e-mail address is

Read more about security in Computerworld's Security Topic Center.

Join the CSO newsletter!

Error: Please check your email address.
Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Gregg Keizer

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place