The plug-in in QuickTime in Apple Mac OS X before 10.6.7 allows remote attackers to bypass the Same Origin Policy and obtain potentially sensitive video data via vectors involving a cross-site redirect.

The mobile device is running a version of iOS that is prior to version 5.0. Version 5.0 contains numerous security-related fixes for the following vulnerabilities :

  - Apple iOS Calendar Synchronization SSL Certificate     Validation Information Disclosure Vulnerability     (CVE-2011-3253)

  - Apple iOS Calendar Cross-Site Scripting Vulnerability     (CVE-2011-3254)

  - Apple iOS CFNetwork Information Disclosure Vulnerability     (CVE-2011-3255)

  - Apple iOS and Mac OS X CFNetwork Cross Domain     Information Disclosure Vulnerability (CVE-2011-3246)

  - Apple Mac OS X CoreFoundation Memory Corruption     Vulnerability (CVE-2011-0259)

  - FreeType Font Document Multiple Memory Corruption     Vulnerabilities (CVE-2011-3256)

  - Apple Mac OS X QuickTime Cross-Domain Information     Disclosure Vulnerability (CVE-2011-0187)

  - Apple iOS Mail Cookie Synchronization Validation     Information Disclosure Vulnerability (CVE-2011-3257)

  - An information disclosure vulnerability, known as BEAST,     exists in the SSL 3.0 and TLS 1.0 protocols due to a     flaw in the way the initialization vector (IV) is     selected when operating in cipher-block chaining (CBC)     modes. A man-in-the-middle attacker can exploit this     to obtain plaintext HTTP header data, by using a     blockwise chosen-boundary attack (BCBA) on an HTTPS     session, in conjunction with JavaScript code that uses     the HTML5 WebSocket API, the Java URLConnection API,     or the Silverlight WebClient API. (CVE-2011-3389)

  - Opera Web Browser Information Disclosure Vulnerability

  - Apple iOS Home Screen Information Disclosure     Vulnerability (CVE-2011-3431)

  - libTIFF CCITT Group 4 Encoded TIFF Image Buffer Overflow     Vulnerability (CVE-2011-0192)

  - Apple Safari ImageIO TIFF Image Handling Heap Buffer     Overflow Vulnerability (CVE-2011-0241)

  - Apple Mac OS X ICU Buffer Overflow Vulnerability     (CVE-2011-0206)

  - Apple Kernel TCP Exhaustion Denial of Service     Vulnerability (CVE-2011-3259)

  - Apple Mac OS X IPV6 Socket Options Denial of Service     Vulnerability (CVE-2011-1132)

  - Apple iOS Keyboard Information Disclosure Vulnerability     (CVE-2011-3245)

  - Apple Safari 'libxml' Remote Code Execution     Vulnerability (CVE-2011-0216)

  - Apple iPhone/iPad/iPod Touch prior to iOS 5 Buffer     Overflow Vulnerability (CVE-2011-3260)

  - Apple iPhone/iPad/iPod Touch prior to iOS 5 Remote Code     Execution Vulnerability (CVE-2011-3261)

  - Apple Mac OS X QuickLook Office File Memory Corruption     Vulnerability (CVE-2011-0208)

  - Apple Mac OS X QuickLook Remote Code Execution     Vulnerability (CVE-2011-0184)

  - Apple iPhone/iPad/iPod Touch 'Content-Disposition'     Header Cross-Site Scripting Vulnerability     (CVE-2011-3246)

  - Apple iOS Parental Restrictions Passcode Information     Disclosure Vulnerability (CVE-2011-3249)

  - Apple iOS Insecure Misleading UI Insecure     Configuration Weakness (CVE-2011-3430)

  - Apple iOS Remote Denial of Service Vulnerability     (CVE-2011-3432)

  - WebKit Memory Corruption Remote Code Execution     Vulnerability (CVE-2011-0218)

  - WebKit Memory Corruption Remote Code Execution     Vulnerability (CVE-2011-0221)

  - WebKit Memory Corruption Remote Code Execution     Vulnerability (CVE-2011-0222)

  - WebKit Memory Corruption Remote Code Execution     Vulnerability (CVE-2011-0225)

  - WebKit Memory Corruption Remote Code Execution     Vulnerability (CVE-2011-0232)

  - WebKit FrameOwner Element Memory Corruption Remote     Code Execution Vulnerability (CVE-2011-0233)

  - WebKit Malformed XHTML Tags Use-After-Free     Memory Corruption Vulnerability (CVE-2011-0234)

  - WebKit Memory Corruption Remote Code Execution     Vulnerability (CVE-2011-0235)

  - WebKit Memory Corruption Remote Code Execution     Vulnerability (CVE-2011-0238)

  - WebKit 'NamedNodeMap.cpp' Memory Corruption Remote     Code Execution Vulnerability (CVE-2011-0254)

  - WebKit Memory Corruption Remote Code Execution     Vulnerability (CVE-2011-0255)

  - Google Chrome prior to 9.0.597.94 Multiple Security     Vulnerabilities (CVE-2011-0981)

  - Google Chrome prior to 9.0.597.107 Multiple Security     Vulnerabilities (CVE-2011-1109)

  - Google Chrome prior to 10.0.648.127 Multiple Security     Vulnerabilities (CVE-2011-1188)

  - WebKit Memory Corruption Remote Code Execution     Vulnerability (CVE-2011-1288)

  - Google Chrome prior to 10.0.648.204 Multiple Security     Vulnerabilities (CVE-2011-1293)

  - Google Chrome prior to 11.0.696.57 Multiple Security     Vulnerabilities (CVE-2011-1449)

  - WebKit MathML Tags Use-After-Free Remote Code Execution     Vulnerability

  - WebKit Memory Corruption Remote Code Execution     Vulnerability (CVE-2011-1453)

  - WebKit Memory Corruption Remote Code Execution     Vulnerability (CVE-2011-1457)

  - WebKit Memory Corruption Remote Code Execution     Vulnerability (CVE-2011-1462)

  - WebKit Memory Corruption Remote Code Execution     Vulnerability (CVE-2011-1797)

  - WebKit Multiple Unspecified Remote Code Execution     Vulnerabilities (CVE-2011-2338)

  - WebKit Style Sheet Elements Remote Code Execution     Vulnerability (CVE-2011-2341)

  - Google Chrome Prior to 12.0.742.112 Multiple Security     Vulnerabilities (CVE-2011-2351)

  - Google Chrome Prior to 13.0.782.107 Multiple Security     Vulnerabilities (CVE-2011-2359)

  - Google Chrome Prior to 13.0.782.215 Multiple Security     Vulnerabilities (CVE-2011-2823)

  - Mozilla Firefox/Thunderbird/SeaMonkey YARR Remote Code     Execution Vulnerability (CVE-2011-3232)

  - Google Chrome Prior to 14.0.835.163 Multiple Security     Vulnerabilities (CVE-2011-3234)

  - WebKit Embedded URL Cross Domain Scripting Vulnerability     (CVE-2011-0242)

  - WebKit Address Bar URI Spoofing Vulnerability     (CVE-2011-1107)

  - WebKit 'libxslt' Remote Code Execution Vulnerability     (CVE-2011-1774)

  - WebKit 'HTML5' Drag and Drop Cross-Origin Information     Disclosure Vulnerability (CVE-2011-0166)

  - WebKit Inactive DOM Windows Cross Domain Scripting     Vulnerability (CVE-2011-3243)

  - Apple iOS WiFi Credentials Information Disclosure     Vulnerability (CVE-2011-3234)

Versions of Mac OS X 10.7 earlier than 10.7.2 are potentially affected by a security issue.  Mac OS X 10.7.2 contains a security fix for the following products : 

  - Apache

  - Application Firewall

  - ATS

 - BIND

  - Certificate Trust Policy

  - CFNetwork

  - CoreMedia

  - CoreProcesses

  - CoreStorage

  - File Systems

  - iChat Server

  - Kernel

  - libsecurity

  - Open Directory

  - PHP

  - python

  - QuickTime

  - SMB File Server

  - X11

The remote host is running a version of Mac OS X 10.7.x that is prior to 10.7.2. This version contains numerous security-related fixes for the following components :

  - Apache
  - Application Firewall
  - ATS
  - BIND
  - Certificate Trust Policy
  - CFNetwork
  - CoreMedia
  - CoreProcesses
  - CoreStorage
  - File Systems
  - iChat Server
  - Kernel
  - libsecurity
  - Open Directory
  - PHP
  - python
  - QuickTime
  - SMB File Server
  - X11

According to its banner, the remote Apple iOS device is missing a security update.  Versions of Apple iOS 3.0 through 4.3.5 are affected by vulnerabilities within the following components :

 - CalDAV
 - Calendar
 - CFNetwork
 - CoreFoundation
 - CoreGraphics
 - CoreMedia
 - Data Access - Data Security
 - Home security
 - ImageIO
 - Kernel
 - Keyboards
 - libxml
 - OfficeImport
 - Safari
 - Settings
 - UIKit Alerts
 - WebKit
 - WiFi

Versions of QuickTime earlier than 7.7 are potentially affected by multiple vulnerabilities :

  - A buffer overflow in QuickTime's handling of pict files may lead to an application crash or arbitrary code execution. (CVE-2011-0245)

  - A buffer overflow in QuickTime's handling of JPEG2000 files may lead to an application crash or arbitrary code execution. (CVE-2011-0186)

  - A cross-origin issue in QuickTime plug-in's handling of cross-site redirects may lead to disclosure of video data from another site. (CVE-2011-0187)

  - An integer overflow in QuickTime's handling of RIFF WAV files may lead to an application crash or arbitrary code execution. (CVE-2011-0209)

  - A memory corruption issue in QuickTime's handling of sample tables in QuickTime movie files may lead to an application crash or arbitrary code execution. (CVE-2011-0210)

  - An integer overflow in QuickTime's handling of audio channels in movie files may lead to an application crash or arbitrary code execution. (CVE-2011-0211)

  - A buffer overflow in QuickTime's handling of JPEG files may lead to an application crash or arbitrary code execution. (CVE-2011-0213)

  - A heap buffer overflow in QuickTime's handling of GIF files may lead to an application crash or arbitrary code execution. (CVE-2011-0246)

  - Multiple stack buffer overflows in QuickTime's handling of H.264 encoded movie files may lead to an application crash or arbitrary code execution. (CVE-2011-0247)

  - A stack buffer overflow in QuickTime ActiveX's handling of QTL files may lead to an application crash or arbitrary code execution. (CVE-2011-0248)

  - A heap buffer overflow in QuickTime's handling of STSC atoms in QuickTime movie files may lead to an application crash or arbitrary code execution. (CVE-2011-0249)

  - A heap buffer overflow in QuickTime's handling of STSS atoms in QuickTime movie files may lead to an application crash or arbitrary code execution. (CVE-2011-0250)

  - A heap buffer overflow in QuickTime's handling of STSZ atoms in QuickTime movie files may lead to an application crash or arbitrary code execution. (CVE-2011-0251)

  - A heap buffer overflow in QuickTime's handling of STTS atoms in QuickTime movie files may lead to an application crash or arbitrary code execution. (CVE-2011-0252)

The version of QuickTime installed on the remote Windows host is older than 7.7.  As such, it reportedly may be affected by the following vulnerabilities :

  - A buffer overflow in QuickTime's handling of pict files     may lead to an application crash or arbitrary code     execution. (CVE-2011-0245)

  - A buffer overflow in QuickTime's handling of JPEG2000     files may lead to an application crash or arbitrary     code execution. (CVE-2011-0186)

  - A cross-origin issue in QuickTime plug-in's handling of     cross-site redirects may lead to disclosure of video     data from another site. (CVE-2011-0187)

  - An integer overflow in QuickTime's handling of RIFF WAV     files may lead to an application crash or arbitrary     code execution. (CVE-2011-0209)

  - A memory corruption issue in QuickTime's handling of     sample tables in QuickTime movie files may lead to an     application crash or arbitrary code execution.
    (CVE-2011-0210)

  - An integer overflow in QuickTime's handling of audio     channels in movie files may lead to an application     crash or arbitrary code execution. (CVE-2011-0211)

  - A buffer overflow in QuickTime's handling of JPEG files     may lead to an application crash or arbitrary code     execution. (CVE-2011-0213)

  - A heap-based buffer overflow in QuickTime's handling of     GIF files may lead to an application crash or arbitrary     code execution. (CVE-2011-0246)

  - Multiple stack-based buffer overflows in QuickTime's     handling of H.264 encoded movie files may lead to an     application crash or arbitrary code execution.
    (CVE-2011-0247)

  - A stack-based buffer overflow in the QuickTime ActiveX's     handling of QTL files may lead to an application crash     or arbitrary code execution. (CVE-2011-0248)

  - A heap-based buffer overflow in QuickTime's handling of     STSC atoms in QuickTime movie files may lead to an     application crash or arbitrary code execution.
    (CVE-2011-0249)

  - A heap-based buffer overflow in QuickTime's handling of     STSS atoms in QuickTime movie files may lead to an     application crash or arbitrary code execution.
    (CVE-2011-0250)

  - A heap-based buffer overflow in QuickTime's handling of     STSZ atoms in QuickTime movie files may lead to an     application crash or arbitrary code execution.
    (CVE-2011-0251)

  - A heap-based buffer overflow in QuickTime's handling of     STTS atoms in QuickTime movie files may lead to an     application crash or arbitrary code execution.
    (CVE-2011-0252)

  - A stack-based buffer overflow in QuickTime's handling of     PICT files may lead to an application crash or arbitrary     code execution. (CVE-2011-0257)

  - An integer overflow in QuickTime's handling of track run     atoms in QuickTime movie files may lead to an     application crash or arbitrary code execution.
    (CVE-2011-0256)

  - Memory corruption in Quicktime's handling of mp4v codec     information. (CVE-2011-0258)

The version of QuickTime installed on the remote Mac OS X host is older than 7.7.  As such, it reportedly may be affected by the following vulnerabilities :

  - A buffer overflow in QuickTime's handling of pict files     may lead to an application crash or arbitrary code     execution. (CVE-2011-0245)

  - A buffer overflow in QuickTime's handling of JPEG2000     files may lead to an application crash or arbitrary     code execution. (CVE-2011-0186)

  - A cross-origin issue in QuickTime plug-in's handling of     cross-site redirects may lead to disclosure of video     data from another site. (CVE-2011-0187)

  - An integer overflow in QuickTime's handling of RIFF WAV     files may lead to an application crash or arbitrary     code execution. (CVE-2011-0209)

  - A memory corruption issue in QuickTime's handling of     sample tables in QuickTime movie files may lead to an     application crash or arbitrary code execution.
    (CVE-2011-0210)

  - An integer overflow in QuickTime's handling of audio     channels in movie files may lead to an application     crash or arbitrary code execution. (CVE-2011-0211)

  - A buffer overflow in QuickTime's handling of JPEG files     may lead to an application crash or arbitrary code     execution. (CVE-2011-0213)

  - A heap-based buffer overflow in QuickTime's handling of     STSC atoms in QuickTime movie files may lead to an     application crash or arbitrary code execution.
    (CVE-2011-0249)

  - A heap-based buffer overflow in QuickTime's handling of     STSS atoms in QuickTime movie files may lead to an     application crash or arbitrary code execution.
    (CVE-2011-0250)

  - A heap-based buffer overflow in QuickTime's handling of     STSZ atoms in QuickTime movie files may lead to an     application crash or arbitrary code execution.
    (CVE-2011-0251)

  - A heap-based buffer overflow in QuickTime's handling of     STTS atoms in QuickTime movie files may lead to an     application crash or arbitrary code execution.
    (CVE-2011-0252)

  - A stack-based buffer overflow in QuickTime's handling of     PICT files may lead to an application crash or arbitrary     code execution. (CVE-2011-0257)

  - An integer overflow in QuickTime's handling of track run     atoms in QuickTime movie files may lead to an     application crash or arbitrary code execution.
    (CVE-2011-0256)

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.7.

Mac OS X 10.6.7 contains security fixes for the following products :

  - AirPort
  - Apache
  - AppleScript
  - ATS
  - bzip2
  - CarbonCore
  - ClamAV
  - CoreText
  - File Quarantine
  - HFS
  - ImageIO
  - Image RAW
  - Installer
  - Kerberos
  - Kernel
  - Libinfo
  - libxml
  - Mailman
  - PHP
  - QuickLook
  - QuickTime
  - Ruby
  - Samba
  - Subversion
  - Terminal
  - X11

Versions of Mac OS X 10.6 earlier than 10.6.7 are potentially affected by a security issue.  Mac OS X 10.6.7 contains a security fix for the following products :

  - Airport

  - Apache

  - AppleScript

  - ATS

  - bzip2

  - CarbonCore

  - ClamAV

  - CoreText

  - HFS

  - ImageIO

  - Image RAW

  - Installer

  - Kerberos

  - Kernel

  - Libinfo

  - libxml

  - Mailman

  - PHP

  - QuickLook

  - QuickTime

  - Ruby

  - Samba

  - Subversion

  - Terminal

  - X11
IAVB Reference : 2010-B-0083
STIG Finding Severity : Category II

Versions of Mac OS X 10.6 earlier than 10.6.7 are potentially affected by a security issue.  Mac OS X 10.6.7 contains a security fix for the following products :

  - Airport

  - Apache

  - AppleScript

  - ATS

  - bzip2

  - CarbonCore

  - ClamAV

  - CoreText

  - HFS

  - ImageIO

  - Image RAW

  - Installer

  - Kerberos

  - Kernel

  - Libinfo

  - libxml

  - Mailman

  - PHP

  - QuickLook

  - QuickTime

  - Ruby

  - Samba

  - Subversion

  - Terminal

  - X11

ID	Name	Product	Family	Severity
60026	Apple iOS < 5.0 Multiple Vulnerabilities (BEAST)	Nessus	Mobile Devices	critical
6039	Mac OS X 10.7 < 10.7.2 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
56480	Mac OS X 10.7.x < 10.7.2 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
6041	Apple iOS < 5.0 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	high
801184	QuickTime < 7.7 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
6000	QuickTime < 7.7 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
55764	QuickTime < 7.7 Multiple Vulnerabilities (Windows)	Nessus	Windows	high
55763	QuickTime < 7.7 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
52754	Mac OS X 10.6.x < 10.6.7 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
800796	Mac OS X 10.6 < 10.6.7 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	high
5826	Mac OS X 10.6 < 10.6.7 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical

Detections

Analytics

CVE-2011-0187

medium

Tenable Plugins

critical

critical

critical

high

high

high

high

high

high

high

critical