The exploits can be carried out through the vulnerabilities when Flash is used with the following browser/operating system combinations:
- Internet Explorer (IE) 6 Service Pack 2 (IE 6, Security Version 1) for Windows (with Flash 9.0.16)
- Firefox 126.96.36.199 for Windows (with Flash 9.0.16)
- Firefox 188.8.131.52 for Linux (with Flash 7.0.63)
The two vulnerabilities reported are as follows:
The addRequestHeader() method insufficiently secures itself, providing a way around a security restriction that does not permit developers to use addRequestHeader() to set headers such as Host, Referer or Content-Length. As a result, it is possible to inject arbitrary headers with HTTP requests. The Rapid7 security paper points out that this vulnerability is similar to other, previously-reported vulnerabilities in Adobe Flash 7 and 8.
The XML.contentType attribute contains the same vulnerability found in the addRequestHeader() and it can be exploited in the same way because Adobe Flash does not check the validity of the attributes value before building the HTTP request.
According to Rapid7, Adobe was notified of the vulnerabilities but has not yet released a fix or upgrade to Adobe Flash Player. To protect from the risk of attack, Rapid7 offers four solutions in the interim:
- Upgrade to the beta version (Flash Player 9.0.18d60 for Windows), which is fixed;
- Only allow trusted Websites to use Flash;
- Use alternative Flash Plugins (GplFlash, Gnash);
- Uninstall Adobe Flash Player.
According to Adobe, there are 700 million Adobe Flash users worldwide.