CVE-2007-6244

Vulnerability

Adobe Flash Player versions 9.x up to 9.0.48.0 and 8.x up to 8.0.35.0 contain multiple cross-site scripting (XSS) vulnerabilities [1][4]. The first issue involves the asfunction: protocol in SWF files, which can be used to inject arbitrary web script or HTML. The second issue affects the navigateToURL function when used with the Flash Player ActiveX Control in Internet Explorer. These vulnerabilities allow remote attackers to inject malicious script into the context of a website hosting a vulnerable Flash file.

Exploitation

An attacker can exploit these vulnerabilities by crafting a malicious SWF file that uses the asfunction: protocol or by leveraging the navigateToURL function in Internet Explorer. The attacker does not require authentication and can deliver the SWF file via any means (e.g., hosting on a website, embedding in an email). The victim must visit a page that loads the malicious SWF file. No user interaction beyond loading the Flash content is needed.

Impact

Successful exploitation allows the attacker to execute arbitrary HTML and script in the security context of the domain hosting the vulnerable Flash file. This can lead to information disclosure, session hijacking, or other actions that the victim's browser can perform on that domain. The attacker gains the same privileges as the victim user within the affected website.

Mitigation

Adobe released updates to address these issues. Fixed versions include Flash Player 9.0.115.0 and 8.0.39.0 (or later) as per Adobe Security Bulletin APSB07-20 [4]. Users should update to the latest Flash Player version. Red Hat also issued an advisory [1] for affected distributions. As a workaround, users can disable ActiveX controls in Internet Explorer or limit access to untrusted Flash files [4].