Buffer overflow in Apple QuickTime before 7.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted ftab atom in a movie file.

Versions older than Quicktime 7.7.5 contain the following vulnerabilities:

  - Multiple buffer overflow vulnerabilities, which can be leveraged by an attacker to execute arbitrary code or application termination (2014-1246, CVE-2014-1248, CVE-2014-1249)

  - An out-of-bounds byte swapping issue in the handling of 'ttfo' elements, which can be leveraged by an attacker to execute arbitrary code or application termination (CVE-2014-1250)

  - A signedness issue in the handling of 'stsz' atoms, which can be leveraged by an attacker to execute arbitrary code or application termination (CVE-2014-1245)

  - A memory corruption issue when handling the 'dref' atoms, which can be leveraged by an attacker to execute arbitrary code or application termination (CVE-2014-1247)

Versions older than Quicktime 7.7.5 contain the following vulnerabilities:

  - An uninitialized pointer issue when handling track lists, which can be leveraged by an attacker to execute arbitrary code or application termination (CVE-2014-1243)

  - Multiple buffer overflow vulnerabilities, which can be leveraged by an attacker to execute arbitrary code or application termination (CVE-2014-1244, 2014-1246, CVE-2014-1248, CVE-2014-1249, CVE-2014-1251)

  - Multiple out-of-bounds byte swapping issues, which can be leveraged by an attacker to execute arbitrary code or application termination (CVE-2014-1250, CVE-2013-1032)

  - A signedness issue in the handling of 'stsz' atoms, which can be leveraged by an attacker to execute arbitrary code or application termination (CVE-2014-1245)

  - A memory corruption issue when handling the 'dref' atoms, which can be leveraged by an attacker to execute arbitrary code or application termination (CVE-2014-1247)

The remote host is running a version of Mac OS X that is older than 10.9.2. The newer version contains numerous security-related fixes for the following components :

  - Apache

  - ATS

  - Certificate Trust Policy

  - CoreAnimation

  - CoreText

  - curl

  - Data Security

  - Date and Time

  - File Bookmark

  - Finder

  - ImageIO

  - NVIDIA Drivers

  - PHP

  - QuickLook

  - QuickTime

An attacker could leverage the most serious of these issues to execute arbitrary code.

The version of QuickTime installed on the remote Windows host is earlier than 7.7.5.  It is, therefore, reportedly affected by the following vulnerabilities :

  - Out-of-bounds byte swapping issues exist in the     handling of QuickTime image descriptions and 'ttfo'     elements. (CVE-2013-1032, CVE-2014-1250)

  - An uninitialized pointer issue exists in the handling of     track lists.  (CVE-2014-1243)

  - Buffer overflow vulnerabilities exist in the handling of     H.264 encoded movie files, 'ftab' atoms, 'ldat' atoms,     PSD images, and 'clef' atoms. (CVE-2014-1244,     CVE-2014-1248, CVE-2014-1249, CVE-2014-1251)

  - A signedness issue exists in the handling of 'stsz'     atoms. (CVE-2014-1245)

  - A memory corruption issue exists in the handling of     'dref' atoms. (CVE-2014-1247)

Successful exploitation of these issues could result in program termination or arbitrary code execution, subject to the user's privileges.

The remote host is running a version of Mac OS X 10.7 or 10.8 that does not have Security Update 2014-001 applied. This update contains several security-related fixes for the following components :

  - Apache
  - App Sandbox
  - ATS
  - Certificate Trust Policy
  - CFNetwork Cookies
  - CoreAnimation
  - Date and Time
  - File Bookmark
  - ImageIO
  - IOSerialFamily
  - LaunchServices
  - NVIDIA Drivers
  - PHP
  - QuickLook
  - QuickTime
  - Secure Transport

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

The remote host is running a version of Mac OS X 10.9.x that is prior to 10.9.2. This update contains several security-related fixes for the following components :

  - Apache
  - ATS
  - Certificate Trust Policy
  - CoreAnimation
  - CoreText
  - curl
  - Data Security
  - Date and Time
  - File Bookmark
  - Finder
  - ImageIO
  - NVIDIA Drivers
  - PHP
  - QuickLook
  - QuickTime

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

ID	Name	Product	Family	Type	Severity
8140	Apple Quicktime 7.7.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		medium
8139	Quicktime (for Windows) < 7.7.5 Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	Web Clients		medium
8138	Mac OS X < 10.9.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		critical
72706	QuickTime < 7.7.5 Multiple Vulnerabilities (Windows)	Nessus	Windows	Local	high
72688	Mac OS X Multiple Vulnerabilities (Security Update 2014-001) (BEAST)	Nessus	MacOS X Local Security Checks	Local	critical
72687	Mac OS X 10.9.x < 10.9.2 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Combined	critical

Detections

Analytics

CVE-2014-1246

high

Tenable Plugins

medium

medium

critical

high

critical

critical