PT-2007-7133 · Adobe+1 · Flash Player+1

Rich Cannings · Published 2007-12-20 · Updated 2018-10-30 · CVE-2007-6244

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Adobe Flash Player versions 8.0.0 through 8.0.35.0 Adobe Flash Player versions 9.0.0 through 9.0.48.0

Description The issue allows remote attackers to inject arbitrary web script or HTML via a SWF file that uses the asfunction: protocol or the navigateToURL function when used with the Flash Player ActiveX Control in Internet Explorer.

Recommendations For Adobe Flash Player versions 8.0.0 through 8.0.35.0, update to a version later than 8.0.35.0 to resolve the issue. For Adobe Flash Player versions 9.0.0 through 9.0.48.0, update to a version later than 9.0.48.0 to resolve the issue. As a temporary workaround, consider disabling the use of the asfunction: protocol and the navigateToURL function in the Flash Player ActiveX Control until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-6244

RHSA-2007:1126

Affected Products

Flash Player

Internet Explorer

References · 26

• 🔥 https://exploit-db.com/exploits/30905 · Exploit
• 🔥 https://exploit-db.com/exploits/30907 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-6244 · Security Note
• http://redhat.com/support/errata/RHSA-2007-1126.html · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-238305-1 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200801-07.xml · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00007.html · Vendor Advisory
• http://secunia.com/advisories/28570 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10210 · Note
• http://securityfocus.com/bid/26929 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39131 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6244 · Note
• http://securityfocus.com/bid/26960 · Note
• http://crypto.stanford.edu/advisories/CVE-2007-6244 · Note
• http://securitytracker.com/id?1019116 · Note