Detections
Analytics
QuickTime < 7.6.2 Multiple Vulnerabilities (Windows)
high Nessus Plugin ID 38988
Language:
Synopsis
The remote Windows host contains an application that is affected by multiple vulnerabilities.Description
The version of QuickTime installed on the remote Windows host is older than 7.6.2. Such versions contain several vulnerabilities :- An integer underflow in QuickTime's handling of PICT images may result in a heap-based buffer overflow and, in turn, to an application crash or arbitrary code execution. (CVE-2009-0010)
- A heap-based buffer overflow in QuickTime's handling of MS ADPCM encoded audio data may lead to an application crash or arbitrary code execution. (CVE-2009-0185)
- A memory corruption issue in QuickTime's handling of Sorenson 3 video files may lead to an application crash or arbitrary code execution. (CVE-2009-0188)
- A heap-basded buffer overflow in QuickTime's handling of FLC compression files may lead to an application crash or arbitrary code execution. (CVE-2009-0951)
- A buffer overflow in QuickTime's handling of compressed PSD image files may lead to an application crash or arbitrary code execution. (CVE-2009-0952)
- A heap-based buffer overflow in QuickTime's handling of PICT image files may lead to an application crash or arbitrary code execution. (CVE-2009-0953)
- A heap-based buffer overflow in QuickTime's handling of Clipping Region (CRGN) atom types in a movie file may lead to an application crash or arbitrary code execution. (CVE-2009-0954)
- A sign extension issue in QuickTime's handling of image description atoms in an Apple video file may lead to an application crash or arbitrary code execution.
(CVE-2009-0955)
- An uninitialized memory access issue in QuickTime's handling of movie files may lead to an application crash or arbitrary code execution. (CVE-2009-0956)
- A heap-based buffer overflow in QuickTime's handling of JP2 image files may lead to an application crash or arbitrary code execution. (CVE-2009-0957)
Solution
Upgrade to QuickTime 7.6.2 or later.See Also
Plugin Details
Severity: High
ID: 38988
File Name: quicktime_762.nasl
Version: 1.18
Type: local
Agent: windows
Family: Windows
Published: 6/2/2009
Updated: 7/31/2020
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: High
Score: 8.9
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 8.1
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2009-0010
Vulnerability Information
CPE: cpe:/a:apple:quicktime
Required KB Items: SMB/QuickTime/Version
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 5/13/2009
Reference Information
CVE: CVE-2009-0010, CVE-2009-0185, CVE-2009-0188, CVE-2009-0951, CVE-2009-0952, CVE-2009-0953, CVE-2009-0954, CVE-2009-0955, CVE-2009-0956, CVE-2009-0957
BID: 34938, 35159, 35161, 35162, 35163, 35164, 35165, 35166, 35167, 35168