CVE - CVE-2006-5330

CVE-ID
CVE-2006-5330	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
CRLF injection vulnerability in Adobe Flash Player plugin 9.0.16 and earlier for Windows, 7.0.63 and earlier for Linux, 7.x before 7.0 r67 for Solaris, and before 9.0.28.0 for Mac OS X, allows remote attackers to modify HTTP headers of client requests and conduct HTTP Request Splitting attacks via CRLF sequences in arguments to the ActionScript functions (1) XML.addRequestHeader and (2) XML.contentType. NOTE: the flexibility of the attack varies depending on the type of web browser being used.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BUGTRAQ:20061017 Rapid7 Advisory R7-0026: HTTP Header Injection Vulnerabilities in the Flash Player Plugin URL:http://www.securityfocus.com/archive/1/448997/100/0/threaded MISC:http://www.rapid7.com/advisories/R7-0026.jsp CONFIRM:http://www.adobe.com/support/security/advisories/apsa06-01.html CONFIRM:http://www.adobe.com/support/security/bulletins/apsb06-18.html CONFIRM:http://docs.info.apple.com/article.html?artnum=305214 APPLE:APPLE-SA-2007-03-13 URL:http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html REDHAT:RHSA-2007:0009 URL:http://www.redhat.com/support/errata/RHSA-2007-0009.html SUNALERT:102932 URL:http://sunsolve.sun.com/search/document.do?assetkey=1-26-102932-1 SUSE:SUSE-SA:2006:077 URL:http://lists.suse.com/archive/suse-security-announce/2006-Dec/0006.html CERT:TA07-072A URL:http://www.us-cert.gov/cas/techalerts/TA07-072A.html BID:20592 URL:http://www.securityfocus.com/bid/20592 OVAL:oval:org.mitre.oval:def:11405 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11405 VUPEN:ADV-2006-4094 URL:http://www.vupen.com/english/advisories/2006/4094 VUPEN:ADV-2007-0930 URL:http://www.vupen.com/english/advisories/2007/0930 VUPEN:ADV-2007-1999 URL:http://www.vupen.com/english/advisories/2007/1999 OSVDB:29863 URL:http://www.osvdb.org/29863 SECTRACK:1017078 URL:http://securitytracker.com/id?1017078 SECUNIA:22467 URL:http://secunia.com/advisories/22467 SECUNIA:23324 URL:http://secunia.com/advisories/23324 SECUNIA:23581 URL:http://secunia.com/advisories/23581 SECUNIA:24479 URL:http://secunia.com/advisories/24479 SECUNIA:25467 URL:http://secunia.com/advisories/25467 SREASON:1737 URL:http://securityreason.com/securityalert/1737 XF:flashplayer-multiple-xsrf(29634) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/29634
Assigning CNA
N/A
Date Entry Created
20061017	Disclaimer: The entry creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20061017)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an entry on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: cve@mitre.org