Apple QuickTime for Java 7.1.6 on Mac OS X and Windows does not properly restrict QTObject subclassing, which allows remote attackers to execute arbitrary code via a web page containing a user-defined class that accesses unsafe functions that can be leveraged to write to arbitrary memory locations.

The version of QuickTime installed on the remote Windows host is older than 7.2.  Such versions contain several vulnerabilities that may allow an attacker to execute arbitrary code on the remote host if he can trick the user to open a specially-crafted file with QuickTime.

The version of QuickTime installed on the remote Mac OS X host is older than 7.2.  Such versions contain several vulnerabilities that may allow an attacker to execute arbitrary code on the remote host if he can trick the user to open a specially crafted file with QuickTime.

The version of QuickTime installed on the remote Windows host is older than 7.2.  Such versions contain several vulnerabilities that may allow an attacker to execute arbitrary code on the remote host if he can trick the user to open a specially crafted file with QuickTime.

The version of QuickTime installed on the remote Windows host is less than 7.1.6.200, the version associated with Apple's Security Update (QuickTime 7.1.6).  As a result, a remote attacker who can trick a user on the affected system into opening a malicious Java applet using QuickTime may be able to execute arbitrary code remotely subject to the user's privileges or to gain read access to the web browser's memory.

According to its version, the installation of Quicktime on the remote Mac OS X host that contains a bug which might allow a rogue Java program to write anywhere in the heap.

An attacker may be able to leverage these issues to execute arbitrary code on the remote host by luring a victim into visiting a rogue page containing a malicious Java applet.

ID	Name	Product	Family	Severity
4132	QuickTime < 7.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
25704	QuickTime < 7.2 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
25703	QuickTime < 7.2 Multiple Vulnerabilities (Windows)	Nessus	Windows	high
25347	QuickTime < 7.1.6 Security Update (Windows)	Nessus	Windows	high
25346	Quicktime Multiple Vulnerabilities (Mac OS X 7.1.6 Security Update)	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2007-2388

critical

Tenable Plugins

medium

high

high

high

high