Viruses/Worms News

Snow Leopard includes malware-vulnerable Adobe Flash version

Thursday, September 3, 2009

Web security firm Sophos reported yesterday that Apple's new Snow Leopard operating system ships with an older version of Adobe Flash Player that is unpatched and vulnerable to cyberattacks. Adobe is warning Snow Leopard users to upgrade to the latest version.

Sophos senior technology consultant Graham Cluley wrote on his blog that Snow Leopard comes with version 10.0.23.1, which is known to have security vulnerabilities. The latest version of Flash Player for Mac is 10.0.32.18.

"Mac users are not informed that Snow Leopard has downgraded their version of Flash without permission and that they are now exposed to a raft of potential attacks and exploits which have been targeted on Adobe's software in recent months," Cluley said in the blog post.

Research from security firm Trusteer shows that almost 80 percent of internet users are still running unpatched versions of Flash, which the company called "the biggest security hole on the internet today," in a white paper last month.

Security researchers have discovered exploits of a Flash vulnerability that could infect PCs with Trojan malware when users open a maliciously crafted Adobe Acrobat PDF file, which caused Adobe to rush a security updates for Flash Player, Acrobat and Reader.

Sophos has identified Flash-exploiting malware embedded in Microsoft Excel files and predicts malware authors will use PowerPoint and Word to spread Flash-based attacks.