Integer signedness error in Apple QuickTime before 7.6.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted panorama atom in a QuickTime Virtual Reality (QTVR) movie file.

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.7.

Mac OS X 10.6.7 contains security fixes for the following products :

  - AirPort
  - Apache
  - AppleScript
  - ATS
  - bzip2
  - CarbonCore
  - ClamAV
  - CoreText
  - File Quarantine
  - HFS
  - ImageIO
  - Image RAW
  - Installer
  - Kerberos
  - Kernel
  - Libinfo
  - libxml
  - Mailman
  - PHP
  - QuickLook
  - QuickTime
  - Ruby
  - Samba
  - Subversion
  - Terminal
  - X11

Versions of Mac OS X 10.6 earlier than 10.6.7 are potentially affected by a security issue.  Mac OS X 10.6.7 contains a security fix for the following products :

  - Airport

  - Apache

  - AppleScript

  - ATS

  - bzip2

  - CarbonCore

  - ClamAV

  - CoreText

  - HFS

  - ImageIO

  - Image RAW

  - Installer

  - Kerberos

  - Kernel

  - Libinfo

  - libxml

  - Mailman

  - PHP

  - QuickLook

  - QuickTime

  - Ruby

  - Samba

  - Subversion

  - Terminal

  - X11
IAVB Reference : 2010-B-0083
STIG Finding Severity : Category II

Versions of Mac OS X 10.6 earlier than 10.6.7 are potentially affected by a security issue.  Mac OS X 10.6.7 contains a security fix for the following products :

  - Airport

  - Apache

  - AppleScript

  - ATS

  - bzip2

  - CarbonCore

  - ClamAV

  - CoreText

  - HFS

  - ImageIO

  - Image RAW

  - Installer

  - Kerberos

  - Kernel

  - Libinfo

  - libxml

  - Mailman

  - PHP

  - QuickLook

  - QuickTime

  - Ruby

  - Samba

  - Subversion

  - Terminal

  - X11

Versions of QuickTime earlier than 7.6.9 are potentially affected by multiple vulnerabilities :

  - A filesystem permission issue may allow a local user on a Windows system to access the contents of the 'Apple Computer' directory in the user's profile. (CVE-2010-0530)

  - A heap buffer overflow in QuickTime's handling of Track Header (tkhd) atoms may lead to an application crash or arbitrary code execution on Windows systems. (CVE-2010-1508)

  - A heap buffer overflow in Quicktime's handling of JP2 images may lead to an application crash or arbitrary code execution. (CVE-2010-3787)

  - Uninitialized memory access issue in QuickTime's handling of JP2, FlashPix, and GIF images may lead to an application crash or arbitrary code execution. (CVE-2010-3788, CVE-2010-3794, CVE-2010-3795)

  - Memory corruption issues in QuickTime's handling of AVI files, movie files, Sorenson encoded movie files, PICT files, FlashPix images, and panorama atoms in QTVR (QuickTime Virtual Reality) movie files may lead to an application crash or arbitrary code execution. (CVE-2010-3789, CVE-2010-3790, CVE-2010-3793, CVE-2010-3800, CVE-2010-3801, CVE-2010-3802)

  - A buffer overflow in QuickTime's handling of MPEG-encoded movie files may lead to an application crash or arbitrary code execution. (CVE-2010-3791)

  - A signedness issue in QuickTime's handling of MPEG-encoded movie files may lead to an application crash or arbitrary code execution. (CVE-2010-3792)

  - An integer overflow in QuickTime's handling of movie files may lead to an application crash or arbitrary code execution. (CVE-2010-4009)

The version of QuickTime installed on the remote Windows host is older than 7.6.9.  Such versions contain several vulnerabilities :

  - A filesystem permission issue may allow a local user     on a Windows system to access the contents of the     'Apple Computer' directory in the user's profile.
    (CVE-2010-0530)

  - A heap-based buffer overflow in QuickTime's handling of     Track Header (tkhd) atoms may lead to an application     crash or arbitrary code execution on Windows systems.
    (CVE-2010-1508)

  - A heap-based buffer overflow in QuickTime's handling of     JP2 images may lead to an application crash or arbitrary     code execution. (CVE-2010-3787)

  - Uninitialized memory access issues in QuickTime's     handling of JP2, FlashPix, and GIF images may lead to     an application crash or arbitrary code execution.
    (CVE-2010-3788, CVE-2010-3794, CVE-2010-3795)

  - Memory corruption issues in QuickTime's handling of     AVI files, movie files, Sorenson encoded movie files,     PICT files, FlashPix images, and panorama atoms in QTVR     (QuickTime Virtual Reality) movie files may lead to an     application crash or arbitrary code execution.
    (CVE-2010-3789, CVE-2010-3790, CVE-2010-3793,     CVE-2010-3800, CVE-2010-3801, CVE-2010-3802)

  - A buffer overflow in QuickTime's handling of MPEG-     encoded movie files may lead to an application crash or     arbitrary code execution. (CVE-2010-3791)

  - A signedness issue in QuickTime's handling of MPEG-     encoded movie files may lead to an application crash or     arbitrary code execution. (CVE-2010-3792)

  - An integer overflow in QuickTime's handling of movie     files may lead to an application crash or arbitrary     code execution. (CVE-2010-4009)

The version of QuickTime installed on the remote Mac OS X host is older than 7.6.9.  Such versions contain several vulnerabilities :

  - A heap buffer overflow in QuickTime's handling of JP2     images may lead to an application crash or arbitrary     code execution. (CVE-2010-3787)

  - Uninitialized memory access issues in QuickTime's     handling of JP2, FlashPix, and GIF images may lead to     an application crash or arbitrary code execution.     (CVE-2010-3788, CVE-2010-3794, CVE-2010-3795)

  - Memory corruption issues in QuickTime's handling of     AVI files, movie files, Sorenson encoded movie files,     PICT files, FlashPix images, and panorama atoms in QTVR     (QuickTime Virtual Reality) movie files may lead to an     application crash or arbitrary code execution.     (CVE-2010-3789, CVE-2010-3790, CVE-2010-3793,     CVE-2010-3800, CVE-2010-3801, CVE-2010-3802)

  - A buffer overflow in QuickTime's handling of MPEG-     encoded movie files may lead to an application crash or     arbitrary code execution. (CVE-2010-3791)

  - A signedness issue in QuickTime's handling of MPEG-     encoded movie files may lead to an application crash or     arbitrary code execution. (CVE-2010-3792)

  - An integer overflow in QuickTime's handling of movie     files may lead to an application crash or arbitrary     code execution. (CVE-2010-4009)

ID	Name	Product	Family	Severity
52754	Mac OS X 10.6.x < 10.6.7 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
800796	Mac OS X 10.6 < 10.6.7 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	high
5826	Mac OS X 10.6 < 10.6.7 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
801191	QuickTime < 7.6.9 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
5725	QuickTime < 7.6.9 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
51062	QuickTime < 7.6.9 Multiple Vulnerabilities (Windows)	Nessus	Windows	high
51061	QuickTime < 7.6.9 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2010-3802

high

Tenable Plugins

high

high

critical

high

medium

high

high