CVE-2009-1879

Vulnerability

The vulnerability is a DOM-based cross-site scripting (XSS) issue in the express-install templates of the Adobe Flex SDK, specifically in index.template.html. The flaw exists in versions before Adobe Flex 3.4. The vulnerability is triggered when the installed Flash Player version is older than the requiredMajorVersion value specified in the template. An attacker can inject arbitrary web script or HTML via the query string [1][2].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious URL that includes a query string with injected script. The attacker does not need authentication, but the victim must have an outdated Flash Player version and be enticed to click the link (user interaction required). The injected script executes in the context of the vulnerable page [1][2].

Impact

Successful exploitation allows remote attackers to execute arbitrary JavaScript in the victim's browser, leading to potential theft of sensitive information, session hijacking, or other malicious actions within the security context of the website using the Flex SDK [1][2].

Mitigation

The vulnerability is fixed in Adobe Flex SDK version 3.4. Users should upgrade to version 3.4 or later. No workaround is documented in the references [1][2].