Adobe warns of Flash/Apache security issue, but gives customers little assistance with the fix

Stephen Withers
Tuesday, 16 March 2010 09:50

Opinion and Analysis

Adobe has warned its Flash Media Server customers of a security vulnerability in the included version of the Apache HTTP Server, but has done little to help them protect themselves against exploits.

Being a well-regarded open source project, the Apache HTTP Server turns up in a lot of guises. But not all of the 'distributors' promptly pass along security updates to their customers.

Apple comes immediately to mind (Apache is the basis of Mac OS X's Web Sharing feature), as there's often a significant gap between the release of patched versions of Apache and their inclusion in a security update from Apple.

Another example is Adobe's Flash Media Server. Version 3.5.x for Windows includes Apache 2.2.9, which has an 'important' security vulnerability now fixed in version 2.2.15.

In its default configuration, Flash Media Server is not vulnerable to this exploit, but it is possible that installed copies have been reconfigured to use the ISAPI module and thus become vulnerable.

Instead of rolling the new version of Apache into a Flash Media Server update to make life easier for users, Adobe has issued instructions for disabling the ISAPI module.

CONTINUED