Problems caused by Adobe Flash Player Plugin vulnerability
Two vulnerabilities found in Adobe Flash Player provide opportunity to attackers to send arbitrary HTTP requests from an unsuspecting user’s browser, reports Rapid7 LLC in a security advisory published today. These vulnerabilities could be used in concert with cross-site request forgery vulnerabilities to steal cookies or other private information. Adobe Flash Player version 9.0.16 for Windows and version 7.0.63 for Linux, as well as earlier versions, are affected.
The exploits can be carried out through the vulnerabilities when Flash is used with the following browser/operating system combinations:
” Internet Explorer (IE) 6 Service Pack 2 (IE 6, Security Version 1) for Windows (with Flash 9.0.16)
” Firefox 1.5.0.6 for Windows (with Flash 9.0.16)
” Firefox 1.5.0.6 for Linux (with Flash 7.0.63)
The two vulnerabilities reported are as follows:
XML.addRequestHeader() Vulnerability
The addRequestHeader() method insufficiently secures itself, providing a way around a security restriction that does not permit developers to use addRequestHeader() to set headers such as Host, Referer or Content-Length. As a result, it is possible to inject arbitrary headers with HTTP requests. The Rapid7 security paper points out that this vulnerability is similar to other, previously-reported vulnerabilities in Adobe Flash 7 and 8.
XML.contentType Vulnerability
The XML.contentType attribute contains the same vulnerability found in the addRequestHeader() and it can be exploited in the same way because Adobe Flash does not check the validity of the attribute’s value before building the HTTP request.