CVE-2006-4640

Vulnerability

Adobe Flash Player versions prior to 9.0.16.0 contain an unspecified vulnerability that allows an attacker to bypass the allowScriptAccess protection mechanism [3]. The allowScriptAccess parameter controls the ability of a Flash SWF file to perform outbound scripting from within a web browser. The exact nature of the defect is not publicly disclosed, but it affects all versions before the fix [3].

Exploitation

Exploitation requires user assistance: the victim must be convinced to view a specially crafted HTML document (such as a web page or HTML email) that contains a malicious Adobe Flash SWF file [3]. No authentication or special network position is needed; the attacker simply hosts the malicious content and lures the victim to access it.

Impact

A successful attack allows the attacker to access content in a different security domain than the one containing the attacker's document [3]. This cross-domain scripting can lead to information disclosure, and potentially further compromise depending on the target domain's content and the attacker's objectives.

Mitigation

Adobe addressed this vulnerability in Flash Player 9.0.16.0, released on September 12, 2006 [3]. Users unable to upgrade should apply the updates listed in Adobe Security Bulletin APSB06-11 [1]. Microsoft also released an update (MS06-069) for affected Windows XP versions that include Flash Player 6 [1]. As a workaround, disabling Flash Player in the web browser reduces the risk of exploitation [3].