Buffer underflow in QuickTime in Apple Mac OS X before 10.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted MPEG file.

Versions of QuickTime earlier thanolder than 7.7.2 are affected by the following vulnerabilities :

  - An uninitialized memory access issue exists in the handling of MP4 encoded files. (CVE-2011-3458)

  - An off-by-one buffer overflow exists in the handling of rdrf atoms in QuickTime movie files. (CVE-2011-3459)

  - A stack buffer overflow exists in the QuickTime plugin's handling of PNG files. (CVE-2011-3460)

  - A stack buffer overflow exists in QuickTime's handling of file paths. (CVE-2012-0265)

  - A buffer overflow exists in the handling of audio sample tables. (CVE-2012-0658)

 - An integer overflow exists in the handling of MPEG files. (CVE-2012-0659)

  - An integer underflow exists in QuickTime's handling of audio streams in MPEG files. (CVE-2012-0660)

  - A use-after-free issue exists in the handling of JPEG2000 encoded movie files. (CVE-2012-0661)

  - Multiple stack overflows exist in QuickTime's handling of TeXML files. (CVE-2012-0663)

  - A heap overflow exists in QuickTime's handling of text tracks. (CVE-2012-0664)

  - A heap overflow exists in the handling of H.264 encoded movie files. (CVE-2012-0665)

  - A stack buffer overflow exists in the QuickTime plugin's handling of QTMovie objects. (CVE-2012-0666)

  - A signedness issue exists in the handling of QTVR movie files. (CVE-2012-0667)

  - A buffer overflow exists in QuickTime's handling of Sorenson encoded movie files. (CVE-2012-0669)

  - An integer overflow exists in QuickTime's handling of sean atoms. (CVE-2012-0670)

  - A memory corruption issue exists in the handling of .pict files. (CVE-2012-0671)

The version of QuickTime installed on the remote Windows host is older than 7.7.2 and may be affected by the following vulnerabilities :

  - An uninitialized memory access issue exists in the     handling of MP4 encoded files. (CVE-2011-3458)

  - An off-by-one buffer overflow exists in the handling of     rdrf atoms in QuickTime movie files. (CVE-2011-3459)

  - A stack-based buffer overflow exists in the QuickTime     plugin's handling of PNG files. (CVE-2011-3460)

  - A stack-based buffer overflow exists in QuickTime's     handling of file paths. (CVE-2012-0265)

  - A buffer overflow exists in the handling of audio sample     tables. (CVE-2012-0658)

  - An integer overflow exists in the handling of MPEG     files. (CVE-2012-0659)

  - An integer underflow exists in QuickTime's handling of     audio streams in MPEG files. (CVE-2012-0660)

  - A use-after-free issue exists in the handling of     JPEG2000 encoded movie files. (CVE-2012-0661)

  - Multiple stack overflows exist in QuickTime's handling     of TeXML files. (CVE-2012-0663)

  - A heap overflow exists in QuickTime's handling of text     tracks. (CVE-2012-0664)

  - A heap overflow exists in the handling of H.264 encoded     movie files. (CVE-2012-0665)

  - A stack-based buffer overflow exists in the QuickTime     plugin's handling of QTMovie objects. (CVE-2012-0666)

  - A signedness issue exists in the handling of QTVR movie     files. (CVE-2012-0667)

  - A buffer overflow exists in QuickTime's handling of     Sorenson encoded movie files. (CVE-2012-0669)

  - An integer overflow exists in QuickTime's handling of     sean atoms. (CVE-2012-0670)

  - A memory corruption issue exists in the handling of     .pict files. (CVE-2012-0671)

The remote host is running a version of Mac OS X 10.7 that is older than version 10.7.4.  The newer version contains numerous security-related fixes for the following components :

  - Login Windows
  - Bluetooth
  - curl
  - HFS
  - Kernel
  - libarchive
  - libsecurity
  - libxml
  - LoginUIFramework
  - PHP
  - Quartz Composer
  - QuickTime
  - Ruby
  - Security Framework
  - Time Machine
  - X11

The remote host is running a version of Mac OS X 10.6 that does not have Security Update 2012-002 applied. This update contains multiple security-related fixes for the following components :

  - curl
  - Directory Service
  - ImageIO
  - libarchive
  - libsecurity
  - libxml
  - Quartz Composer
  - QuickTime
  - Ruby
  - Samba
  - Security Framework

The remote host is running a version of Mac OS X 10.7.x that is prior to 10.7.4. The newer version contains numerous security-related fixes for the following components :

  - Login Window
  - Bluetooth
  - curl
  - HFS
  - Kernel
  - libarchive
  - libsecurity
  - libxml
  - LoginUIFramework
  - PHP
  - Quartz Composer
  - QuickTime
  - Ruby
  - Security Framework
  - Time Machine
  - X11

Note that this update addresses the recent FileVault password vulnerability, in which user passwords are stored in plaintext to a system-wide debug log if the legacy version of FileVault is used to encrypt user directories after a system upgrade to Lion. Since the patch only limits further exposure, though, we recommend that all users on the system change their passwords if user folders were encrypted using the legacy version of FileVault prior to and after an upgrade to OS X 10.7.

ID	Name	Product	Family	Type	Severity
6489	QuickTime < 7.7.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		high
59113	QuickTime < 7.7.2 Multiple Vulnerabilities (Windows)	Nessus	Windows	Local	high
6482	Mac OS X 10.7 < 10.7.4 Multiple Vulnerabilities	Nessus Network Monitor	Generic		critical
59067	Mac OS X Multiple Vulnerabilities (Security Update 2012-002) (BEAST)	Nessus	MacOS X Local Security Checks	Local	critical
59066	Mac OS X 10.7.x < 10.7.4 Multiple Vulnerabilities (BEAST)	Nessus	MacOS X Local Security Checks	Combined	critical

Detections

Analytics

CVE-2012-0660

high

Tenable Plugins

high

high

critical

critical

critical