September 2nd, 2009
Snow Leopard ships with vulnerable Flash Player
Apple’s new operating system comes with an outdated version of Flash Player that exposes Mac users to hacker attacks.
The initial release of Mac OS X 1..6 (Snow Leopard) includes Flash Player 10.0.23.1, which is very much out of date. The fully patched version of Flash Player for Mac is version 10.0.32.18.
[ SEE: Apple adds malware blocker in Snow Leopard ]
Even worse, Intego reports that the vulnerable version of Flash is included even if the Mac user was fully patched before upgrading the operating system.
The current version of Flash Player for Mac is 10.0.32.18, but if you go to the Flash Player version test page after installing Snow Leopard, you’ll find that you have version 10.0.23.1, even if you were up-to-date before the upgrade. It seems that Apple is shipping an outdated, even dangerous version of Flash Player.
Adobe has also spotted the hiccup and released a security alert to warn of the problem.
The initial release of Mac OS X 10.6 (Snow Leopard) includes an earlier version of Adobe Flash Player than what is available from Adobe.com. We recommend all users update to the latest, most secure version of Flash Player (10.0.32.18) — which supports Snow Leopard and is available for download from http://www.adobe.com/go/getflashplayer.
Snow Leopard also includes a rudimentary file quarantine feature to help block known malware attacks against Mac OS X users.
Ryan Naraine is a journalist and security evangelist at Kaspersky Lab. He manages Threatpost.com, a security news portal. Here is Ryan's full profile and disclosure of his industry affiliations.
For daily updates on Ryan's activities, follow him on Twitter.
Subscribe to Zero Day via Email alerts or RSS.
