CVE-2007-5275: Input Validation
The Adobe Macromedia Flash 9 plug-in allows remote attackers to cause a victim machine to establish TCP sessions with arbitrary hosts via a Flash (SWF) movie, related to lack of pinning of a hostname to a single IP address after receiving an allow-access-from element in a cross-domain-policy XML document, and the availability of a Flash Socket class that does not use the browser's DNS pins, aka DNS rebinding attacks, a different issue than CVE-2002-1467 and CVE-2007-4324.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-5275?
The severity of CVE-2007-5275 is considered moderate due to its potential to allow remote exploitation.
How do I fix CVE-2007-5275?
To fix CVE-2007-5275, upgrade to a patched version of Adobe Macromedia Flash 9 as released by Adobe.
What types of attacks can exploit CVE-2007-5275?
CVE-2007-5275 can be exploited through malicious SWF files that manipulate cross-domain access.
Who is affected by CVE-2007-5275?
Users of Adobe Shockwave Player version 9 are specifically affected by CVE-2007-5275.
What is the root cause of CVE-2007-5275?
The root cause of CVE-2007-5275 is the lack of hostname pinning in cross-domain policy handling.