CVE-2007-6245

Vulnerability

Adobe Flash Player versions 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0 contain a vulnerability that allows remote attackers to modify HTTP headers in client requests generated by the Flash Player. This enables HTTP Request Splitting attacks, where an attacker can inject arbitrary headers into HTTP requests made by the player. The affected versions are those prior to the fixes released in later updates [2].

Exploitation

An attacker must entice a user to open a specially crafted SWF file, typically via a web browser. The malicious Flash file can manipulate the HTTP headers of requests made by the Flash Player, allowing the attacker to inject additional headers or split the request into multiple HTTP messages. No authentication or special network position is required beyond the ability to deliver the SWF file to the victim [2].

Impact

Successful exploitation allows the attacker to conduct HTTP Request Splitting, which can lead to cache poisoning, session hijacking, cross-site scripting (XSS), or other attacks that rely on manipulating HTTP traffic. The attacker can modify or inject headers, potentially affecting the security of web applications that rely on proper HTTP request structure [2].

Mitigation

Adobe released updated versions of Flash Player to address this issue. Users should upgrade to Flash Player 9.0.115.0 or later for the 9.x branch, and corresponding updates for 8.x and 7.x branches. Red Hat issued advisory RHSA-2007-1126 [1] and Gentoo published GLSA 200801-07 [2] recommending the upgrade. No workaround is available for unpatched versions [2].