Update on Latest Zero-Day Windows XP and Windows Server 2003 Vulnerability

Right before the Thanksgiving break, Microsoft confirmed a flaw in Windows XP and Windows Server 2003 that could result in an elevation of privilege. You can catch all the details here: Microsoft Announces New Zero-Day Flaw Targeting Windows XP and Windows Server 2003.

New information has come to light on the issue. The exploit is centered on earlier Adobe Reader versions and updating to the latest Adobe Reader will help eliminate the potential for disaster. Adobe has long been a common attack point on Windows PCs, and the company has never been able to shake the public perception of producing a highly unsecure software. Back in August 2013, Adobe initiated an effort to try and change public opinion, which really came about 5 years too late. In What Adobe Has Done to Improve Security, they communicated their determination and provided some very logical methods for moving forward. However, Adobe also has a consumer problem. The majority of consumers just want their computer to work without having to install constant updates. I can't tell you how many times I've seen friends and family continue clicking the "remind me later" button for updates. Adobe has improved security in their most current releases, however unless the end-user willingly updates, Adobe's security sentiment still sits in the can.

Reader versions all the way up to 11.0.02 are vulnerable, causing the issue.

In Microsoft Security Advisory (2914486), Microsoft has offered a workaround, but that workaround breaks certain telephony functions on a PC running the older operating systems.

Others have offered other mitigations, including:

Windows XP loses life on April 8, 2014 and many are now scrambling to upgrade before the deadline. Even for those sitting midway in their Windows XP migration projects would have to work 24 hours a day to upgrade the OS just to minimize the attack of an Adobe Reader flaw. It's much easier to just deploy the latest Adobe Reader version and get back to normal operations – for a while.