[Informational]

Last week, I did up a simple graph detailing the pattern of MS bulletin releases for the year 2010 to date. You can see it here together with the September 2010 MS Security Patches post. This week, I thought it would be interesting to see how the MS bulletins relate to that of Adobe's as we see the increasing amount of patching from Adobe. Obviously, this then ties in with the recent annoucement Adobe made on working and collaborating together with Microsoft to release security patches. You can read more about that here on the Adobe blogsite. I have extracted the key portion below:

Q: If you are willing to work with partners for distribution of patches, how about Microsoft and WSUS? Do you have a way of pushing updates from a local server within the organization instead of all workstations needing to connect to Adobe, like Microsoft WSUS server?
A: Today, enterprise customers typically disable the update mechanism built into the product and use their own enterprise tools for deploying our updates (which we make available to them from the support download section of our Web site). Microsoft and Adobe are working closely together to help improve the software update experience for our mutual customers. Through this collaboration we hope to make it easier for Microsoft System Center Configuration Manager (SCCM) and Microsoft System Center Essentials (SCE) customers to import Adobe updates through the Microsoft System Center Updates Publisher (SCUP) and manage their distribution to client computers.

http://blogs.adobe.com/asset/2010/03/follow-up_to_threatpost_live_c.html

MS vs Adobe 2010

With Microsoft System Center Updates Publisher (SCUP), the process for patching Adobe products now looks set to be more of a breeze. Looking at the graph, we can see a pretty constant trickle of Adobe patches being issued and these have all been previously and currently been deployed through the more traditional Software Distribution methods through ConfigMgr, which may not be the most efficient method of doing so now that you got SCUP in the picture. For the year 2010, Adobe has already released at least 28 bulletins to date addressing various security issues across their products, the latest addressing a vulnerability in Flash which was released on September 20. This is a step forward indeed for ConfigMgr and I envision that this will become pretty mainstream soon. And I won't be surprise if we see other enterprise products using SCUP as a delivery and detection mechanism as well for their patch management in future. Stay tuned!