CVE-2007-5275

Published: Oct 8, 2007Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The Adobe Macromedia Flash 9 plug-in allows remote attackers to cause a victim machine to establish TCP sessions with arbitrary hosts via a Flash (SWF) movie, related to lack of pinning of a hostname to a single IP address after receiving an allow-access-from element in a cross-domain-policy XML document, and the availability of a Flash Socket class that does not use the browser's DNS pins, aka DNS rebinding attacks, a different issue than CVE-2002-1467 and CVE-2007-4324.

Affected (1)

Products: Adobe: Shockwave Player

Adobe

1 product

Shockwave Player

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Adobe Shockwave Player	Version 9

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (56)

http://crypto.stanford.edu/dns/dns-rebinding.pdf

Source: cve@mitre.org

http://lists.apple.com/archives/security-announce/2008//May/msg00001.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00007.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00006.html

Source: cve@mitre.org

http://secunia.com/advisories/28157

Source: cve@mitre.org

http://secunia.com/advisories/28161

Source: cve@mitre.org

http://secunia.com/advisories/28213

Source: cve@mitre.org

http://secunia.com/advisories/28570

Source: cve@mitre.org

http://secunia.com/advisories/29763

Source: cve@mitre.org

http://secunia.com/advisories/29865

Source: cve@mitre.org

http://secunia.com/advisories/30430

Source: cve@mitre.org

http://secunia.com/advisories/30507

Source: cve@mitre.org

http://securitytracker.com/id?1019116

Source: cve@mitre.org

http://sunsolve.sun.com/search/document.do?assetkey=1-26-238305-1

Source: cve@mitre.org

http://www.adobe.com/support/security/bulletins/apsb07-20.html

Source: cve@mitre.org

http://www.adobe.com/support/security/bulletins/apsb08-11.html

Source: cve@mitre.org

http://www.gentoo.org/security/en/glsa/glsa-200801-07.xml

Source: cve@mitre.org

http://www.gentoo.org/security/en/glsa/glsa-200804-21.xml

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2007-1126.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2008-0221.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/26930

Source: cve@mitre.org

http://www.us-cert.gov/cas/techalerts/TA07-355A.html

Source: cve@mitre.org

US Government Resource

http://www.us-cert.gov/cas/techalerts/TA08-100A.html

Source: cve@mitre.org

US Government Resource

http://www.us-cert.gov/cas/techalerts/TA08-150A.html

Source: cve@mitre.org

US Government Resource

http://www.vupen.com/english/advisories/2007/4258

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/1697

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/1724/references

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9250

Source: cve@mitre.org

http://crypto.stanford.edu/dns/dns-rebinding.pdf