Apple QuickTime for Java 7.1.6 on Mac OS X and Windows does not clear potentially sensitive memory before use, which allows remote attackers to read memory from a web browser via unknown vectors related to Java applets.

The version of QuickTime installed on the remote Windows host is older than 7.2.  Such versions contain several vulnerabilities that may allow an attacker to execute arbitrary code on the remote host if he can trick the user to open a specially-crafted file with QuickTime.

The version of QuickTime installed on the remote Mac OS X host is older than 7.2.  Such versions contain several vulnerabilities that may allow an attacker to execute arbitrary code on the remote host if he can trick the user to open a specially crafted file with QuickTime.

The version of QuickTime installed on the remote Windows host is older than 7.2.  Such versions contain several vulnerabilities that may allow an attacker to execute arbitrary code on the remote host if he can trick the user to open a specially crafted file with QuickTime.

The version of QuickTime installed on the remote Windows host is less than 7.1.6.200, the version associated with Apple's Security Update (QuickTime 7.1.6).  As a result, a remote attacker who can trick a user on the affected system into opening a malicious Java applet using QuickTime may be able to execute arbitrary code remotely subject to the user's privileges or to gain read access to the web browser's memory.

According to its version, the installation of Quicktime on the remote Mac OS X host that contains a bug which might allow a rogue Java program to write anywhere in the heap.

An attacker may be able to leverage these issues to execute arbitrary code on the remote host by luring a victim into visiting a rogue page containing a malicious Java applet.

ID	Name	Product	Family	Type	Severity
4132	QuickTime < 7.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		medium
25704	QuickTime < 7.2 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	Local	high
25703	QuickTime < 7.2 Multiple Vulnerabilities (Windows)	Nessus	Windows	Local	high
25347	QuickTime < 7.1.6 Security Update (Windows)	Nessus	Windows	Local	high
25346	Quicktime Multiple Vulnerabilities (Mac OS X 7.1.6 Security Update)	Nessus	MacOS X Local Security Checks	Local	high

Detections

Analytics

CVE-2007-2389

high

Tenable Plugins

medium

high

high

high

high