The "Save for Web" selection in QuickTime Player in Apple Mac OS X through 10.6.8 exports HTML documents that contain an http link to a script file, which allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks by spoofing the http server during local viewing of an exported document.

The version of QuickTime installed on the remote Windows host is older than 7.7.1 and may be affected by the following vulnerabilities :

  - A cross-site scripting issue exists in HTML files     generated by the 'Save for Web' export feature.
    (CVE-2011-3218)

  - A buffer overflow error exists in the handling of     H.264 encoded video files. (CVE-2011-3219)

  - An error exists in the processing of URL data handlers     in movie files and can allow access to uninitialized     areas of memory. (CVE-2011-3220)

  - An error exists in the handling of the 'atoms'     hierarchy as well as 'TKHD atoms' in movie files.
    (CVE-2011-3221, CVE-2011-3251)

  - Buffer overflow errors exist in the processing of     of FlashPix, FLIC, PICT and FLC-encoded files.     (CVE-2011-3222, CVE-2011-3223, CVE-2011-3247,     CVE-2011-3249)

  - An unspecified error can allow memory corruption when     viewing certain video files. (CVE-2011-3228)

  - An error related to signedness exists in the handling     of font tables in QuickTime video files. (CVE-2011-3248)

  - An integer overflow error exists in the handling of     JPEG2000 encoded video files. (CVE-2011-3250)

Versions of QuickTime earlier than 7.7.1 are potentially affected by multiple vulnerabilities :

  - A buffer overflow exists in the handling of H.264 encoded movie files. (CVE-2011-3219)

  - An uninitialized memory access issue exists in the handling of URL data handlers within movie file. (CVE-2011-3220)

  - An implementation issue exists in the handling of the atom hierarchy within a movie files. (CVE-2011-3221)

  - A cross-site scripting issue exists int he Save for Web export. (CVE-2011-3218)

  - A buffer overflow exists in the handling of FlashPix files. (CVE-2011-3222)

  - A buffer overflow exists in the handling of FLIC files. (CVE-2011-3223)

  - Multiple memory corruption issues exist in the handling of movie files. (CVE-2011-3228)

  - An integer overflow issue exists in the handling of PICT files. (CVE-2011-3247)

  - A signedness issue exists in the handling of font tables embedded n QuickTime movie files.

  - A buffer overflow issue exists in the handling of FLC encoded movie files. (CVE-2011-3249)

  - An integer overflow issue exists in the handling of JPEG2000 encoded movie files. (CVE-2011-3250)

  - A memory corruption issue exists in the handling of TKHD atoms in QuickTime movie files. (CVE-2011-3251)

The remote host is running a version of Mac OS X 10.6 that does not have Security Update 2011-006 applied.  This update contains numerous security-related fixes for the following components :

  - Apache
  - Application Firewall
  - ATS
  - BIND
  - Certificate Trust Policy
  - CFNetwork
  - CoreFoundation
  - CoreMedia
  - File Systems
  - IOGraphics
  - iChat Server
  - Mailman
  - MediaKit
  - PHP
  - postfix
  - python
  - QuickTime
  - Tomcat
  - User Documentation
  - Web Server
  - X11

ID	Name	Product	Family	Severity
56667	QuickTime < 7.7.1 Multiple Vulnerabilities (Windows)	Nessus	Windows	high
6052	QuickTime < 7.7.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
56481	Mac OS X Multiple Vulnerabilities (Security Update 2011-006)	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2011-3218

medium

Tenable Plugins

high

high

critical