[ANNOUNCE] Flash Player 9.0.115.0 getURL("javascript:..") failure LIVE cross-domain

Question

2/21/08 Update:
There is a technote covering these two issues.
"getURL and navigateToURL issues with Flash Player 9.0.115.0
ActiveX control"
http://www.adobe.com/go/kb403072
As of today we have two open bugs specific to Flash Player
9.0.115.0 ActiveX control and the use of getURL("javascript:...")
syntax..
I will be writing a technote describing the workarounds today
or tomorrow, but I wanted to share some of my testing with the
community so you can see what the story is.
Issue one:
getURL("javascript:blah()") failing when the content is local
to a drive or cd or dvd. This is a legit bug, not a problem with
FlashPlayer trust.
This post does not describe issueone , but you -can- use the
source FLA's to test issue one.
Issue two:
getURL("javascript") failing with live content if the HTML
and SWF are in separate domains. IE6 and IE7 only.
ExternalInterface has been successful as a workaround for
that as well (in my tests at least...)
At this point I cannot provide an ETA on any fixes, though I
am pushing hard for these to be addressed in the next planned
update (no, i cannot tell you when that is, sorry).
OK now for my testing.
Each test uses the same SWF setup, but the javascript and
html change as necessary. The results of –my- testing are
below each link.
All my tests are with Flash Player 9.0.115.0. As most on the
thread surely know these bugs were injected in the 9.0.115.0
development process and do not appear in 9.0.47.0....
There are four tests in each version (top to bottom)
-- button 1: getURL
-- button 2: externalInterface passing a string via a
variable, which is caught by javascript in the HTML page
-- button 3: fscommand
-- button 4: externalInterface calling 'window.open' directly
with no in-page javascript
-- Buttons 1 through 3 (top to bottom) fire an alert, put
some text into the debug text box in the SWF and open a new window.
-- Button 4 only opens a new window, puts some text into the
debug text box, but no alert (because it’s a direct call to
window.open)
Scenario 1:
HTML and SWF in same domain, no frames
The original AS2 version:
http://www.bentimagemedia.com/escalations/cs3_getURL/getURL_AS2.html
FireFox OSX – all pass
FireFox XP – all pass
IE6 XP – all pass
IE7 Vista - all pass
The AS3 version:
http://www.bentimagemedia.com/escalations/cs3_getURL/getURL_AS3.html
FireFox OSX – all pass
FireFox XP – all pass
IE6 XP – all pass
IE7 Vista - all pass
Scenario 2:
HTML and SWF in same domain, frameset, calls going to same
frames – this setup has two horizontal frames with the AS2
version of the SWF in the top, the AS3 version in the bottom.
http://www.bentimagemedia.com/escalations/cs3_getURL/frames/getURL_frames.html
FireFox OSX – all pass
FireFox XP – all pass
IE6 XP – all pass
IE7 Vista - all pass
Scenario 3: (THIS IS ISSUE TWO ABOVE)
HTML and SWF on different domains, calls going to the same
frames – same swf’s, same setup with modified HTML. The
HTML lives on bentimagemedia, but the SWF’s are embedded from
supportflash.com
http://www.bentimagemedia.com/escalations/cs3_getURL/frames_crossdomain/getURL_frames_cros sdomain.html
FireFox OSX – all pass
FireFox XP - all pass
IE6 XP – Button 1 getURL("javascript"...) fires
function, but does not open new window.
- all other buttons pass
IE7 Vista - Button 1 getURL("javascript...) fires function,
no new window same as IE6.
-- all other buttons pass

Answer 1

We are currently using Adobe Flash player 9 on Windows XP operating system. We would like to know if Vulnerabilities in Adobe Flash Player 6 Provided in Windows XP, could Allow Remote Code Execution mentioned in Microsoft Security Advisory (979267), is resolved in Flash Player 9? For more details on vulnerability please refer "Microsoft Security Advisory (979267)". I have been wondering for the answers from a week and I have even logged the same in forum which fetch me no result. Could you let me know regarding this.
Since we have security related issue with this please consider this call at high priority.
~
Satu28