PT-2006-6051 · Adobe · Flash Player

Marc Bevand · Published 2006-10-17 · Updated 2018-10-17 · CVE-2006-5330

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Adobe Flash Player plugin versions 9.0.16 and earlier for Windows Adobe Flash Player plugin versions 7.0.63 and earlier for Linux Adobe Flash Player plugin versions 7.x before 7.0 r67 for Solaris Adobe Flash Player plugin versions before 9.0.28.0 for Mac OS X

Description The issue allows remote attackers to modify HTTP headers of client requests and conduct HTTP Request Splitting attacks via CRLF sequences in arguments to the ActionScript functions XML.addRequestHeader and XML.contentType. The flexibility of the attack varies depending on the type of web browser being used.

Recommendations For Adobe Flash Player plugin version 9.0.16 and earlier for Windows, update to a version later than 9.0.16. For Adobe Flash Player plugin version 7.0.63 and earlier for Linux, update to a version later than 7.0.63. For Adobe Flash Player plugin version 7.x before 7.0 r67 for Solaris, update to version 7.0 r67 or later. For Adobe Flash Player plugin version before 9.0.28.0 for Mac OS X, update to version 9.0.28.0 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2006-5330

RHSA-2007:0009

Affected Products

Flash Player

References · 26

• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102932-1 · Vendor Advisory
• http://secunia.com/advisories/22467 · Vendor Advisory
• http://lists.suse.com/archive/suse-security-announce/2006-Dec/0006.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-5330 · Security Note
• http://secunia.com/advisories/24479 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html · Vendor Advisory
• http://secunia.com/advisories/23581 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-0009.html · Vendor Advisory
• http://secunia.com/advisories/23324 · Vendor Advisory
• http://secunia.com/advisories/25467 · Vendor Advisory
• http://vupen.com/english/advisories/2007/1999 · Note
• http://vupen.com/english/advisories/2006/4094 · Note
• http://adobe.com/support/security/bulletins/apsb06-18.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5330 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29634 · Note