Did the BugBlog help you? Donate via PayPal to say thanks.

Even better, subscribe to the BugBlog Plus for even more coverage of bugs and their fixes.

Order books and more at Amazon.com

Order Windows 2000 Secrets from Amazon.com

BugBlog Bug of the Month

Every month the BugBlog picks its Bug of the Month, representing the most significant bug found in the past month. Sometimes, the bug will be the one which could potentially cause the most damage; sometimes it will be the bug which affects the most users. And sometimes, it will be the bug that is just the most interesting bug. This bug will be selected either from the free Bug of the Day, or from the subscription-only BugBlog Plus.

The April Bug of the Month appeared in the BugBlog on March 16:

Adobe has patched some critical bugs in the Adobe Macromedia Flash Player. A remote attacker could design a Flash file that, when played on the victim's computer, could take complete control of the system. Everybody using Flash Player 8.0.22.0 and earlier should update to Flash Player 8.0.24.0. Get the update at http://www.macromedia.com/devnet/security/security_zone/apsb06-03.html. Note that Flash Player is distributed with Microsoft Internet Explorer, so that most people using IE will be vulnerable to this. If you are still using Flash Player 7, see http://www.macromedia.com/cfusion/knowledgebase/index.cfm?id=d9c2fe33.

Why this bug? First of all is the impact; if successful, an attacker can take complete control of your system. Second of all is the scope; among Windows users, Flash Player has an extremely high distribution rate. Most users of Microsoft Internet Explorer and Mozilla Firefox will have a Flash player plug-in for their browser. For those two reasons, Adobe (or what used to be Macromedia) wins The Bug of the Month.

Previous Bugs of the Month

March 2006: Microsoft Windows Media Player

Feb 2006: Apple QuickTime

Jan 2006: Microsoft WMF Bug

Dec 2005: Sony's Secret DRM Scheme Leaves Users Exposed

November 2005: Four Separate Bugs Leave Windows Open to Takeover

October 2005: Acrobat Screws Up MS Word

September 2005: Apple Security Update Breaks 64-bit Apps

August 2005: Cisco IOS Vulnerable to IPv6 bug

July 2005: RealNetworks Fixes Four Bugs in Their Media Player

June 2005: Flawed Rollout for Netscape 8

May 2005: TCP/IP Fix for Windows

April 2005: Denial of Service against Symantec Norton AntiVirus

March 2005: IDN Spoofing Bug

February 2005: Windows Animated Cursor Bug

January 2005: Windows Firewall Problems with Dial-up connections

The Bug of the Month is also posted at Blogcritics.org