CVE-2006-5330

Severity Score

7.5

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

CRLF injection vulnerability in Adobe Flash Player plugin 9.0.16 and earlier for Windows, 7.0.63 and earlier for Linux, 7.x before 7.0 r67 for Solaris, and before 9.0.28.0 for Mac OS X, allows remote attackers to modify HTTP headers of client requests and conduct HTTP Request Splitting attacks via CRLF sequences in arguments to the ActionScript functions (1) XML.addRequestHeader and (2) XML.contentType. NOTE: the flexibility of the attack varies depending on the type of web browser being used.

Vulnerabilidad de inyección CRLF en Adobe Flash Player plugin 9.0.16 y anteriores para Windows, 7.0.63 y anteriores para Linux, 7.x anterior a 7.0 r67 para Solaris y anterior a 9.0.28.0 para Mac OS X, permite a atacantes remotos modificar cabeceras HTTP de las peticiones del cliente y dirigir ataques de división de petición HTTP mediante secuencias CRLF en argumentos a las funciones ActionScript (1) XML.addRequestHeader y (2) XML.contentType. NOTA: la flexibilidad del ataque varía dependiendo del tipo de navegador web utilizado.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2006-10-17 CVE Reserved
2006-10-17 CVE Published
2024-08-07 CVE Updated
2024-12-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CAPEC

References (26)

URL	Tag	Source
http://docs.info.apple.com/article.html?artnum=305214	X_refsource_confirm
http://securityreason.com/securityalert/1737	Third Party Advisory
http://securitytracker.com/id?1017078	Vdb Entry
http://www.adobe.com/support/security/advisories/apsa06-01.html	X_refsource_confirm
http://www.adobe.com/support/security/bulletins/apsb06-18.html	X_refsource_confirm
http://www.osvdb.org/29863	Vdb Entry
http://www.rapid7.com/advisories/R7-0026.jsp	X_refsource_misc
http://www.securityfocus.com/archive/1/448997/100/0/threaded	Mailing List
http://www.securityfocus.com/bid/20592	Vdb Entry
http://www.us-cert.gov/cas/techalerts/TA07-072A.html	Third Party Advisory
http://www.vupen.com/english/advisories/2006/4094	Vdb Entry
http://www.vupen.com/english/advisories/2007/0930	Vdb Entry
http://www.vupen.com/english/advisories/2007/1999	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/29634	Vdb Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11405	Signature

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html	2018-10-17
http://lists.suse.com/archive/suse-security-announce/2006-Dec/0006.html	2018-10-17
http://secunia.com/advisories/22467	2018-10-17
http://secunia.com/advisories/23324	2018-10-17
http://secunia.com/advisories/23581	2018-10-17
http://secunia.com/advisories/24479	2018-10-17
http://secunia.com/advisories/25467	2018-10-17
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102932-1	2018-10-17
http://www.redhat.com/support/errata/RHSA-2007-0009.html	2018-10-17
https://access.redhat.com/security/cve/CVE-2006-5330	2007-01-09
https://bugzilla.redhat.com/show_bug.cgi?id=1618210	2007-01-09

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Adobe Search vendor "Adobe"		Flash Player Search vendor "Adobe" for product "Flash Player"				<= 7.0.63 Search vendor "Adobe" for product "Flash Player" and version " <= 7.0.63"		linux		Affected
Adobe Search vendor "Adobe"		Flash Player Search vendor "Adobe" for product "Flash Player"				<= 7.0_r67 Search vendor "Adobe" for product "Flash Player" and version " <= 7.0_r67"		solaris		Affected
Adobe Search vendor "Adobe"		Flash Player Search vendor "Adobe" for product "Flash Player"				<= 9.0.16 Search vendor "Adobe" for product "Flash Player" and version " <= 9.0.16"		windows		Affected
Adobe Search vendor "Adobe"		Flash Player Search vendor "Adobe" for product "Flash Player"				<= 9.0.28.0 Search vendor "Adobe" for product "Flash Player" and version " <= 9.0.28.0"		mac_os_x		Affected