QuickTime < 7.7.2 Multiple Vulnerabilities (Windows)

Severity

Theme

QuickTime < 7.7.2 Multiple Vulnerabilities (Windows)

high Nessus Plugin ID 59113

Language:

New! Plugin Severity Now Using CVSS v3

The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Synopsis

The remote Windows host contains an application that may be affected by multiple vulnerabilities.

Description

The version of QuickTime installed on the remote Windows host is older than 7.7.2 and may be affected by the following vulnerabilities :

- An uninitialized memory access issue exists in the handling of MP4 encoded files. (CVE-2011-3458)

- An off-by-one buffer overflow exists in the handling of rdrf atoms in QuickTime movie files. (CVE-2011-3459)

- A stack-based buffer overflow exists in the QuickTime plugin's handling of PNG files. (CVE-2011-3460)

- A stack-based buffer overflow exists in QuickTime's handling of file paths. (CVE-2012-0265)

- A buffer overflow exists in the handling of audio sample tables. (CVE-2012-0658)

- An integer overflow exists in the handling of MPEG files. (CVE-2012-0659)

- An integer underflow exists in QuickTime's handling of audio streams in MPEG files. (CVE-2012-0660)

- A use-after-free issue exists in the handling of JPEG2000 encoded movie files. (CVE-2012-0661)

- Multiple stack overflows exist in QuickTime's handling of TeXML files. (CVE-2012-0663)

- A heap overflow exists in QuickTime's handling of text tracks. (CVE-2012-0664)

- A heap overflow exists in the handling of H.264 encoded movie files. (CVE-2012-0665)

- A stack-based buffer overflow exists in the QuickTime plugin's handling of QTMovie objects. (CVE-2012-0666)

- A signedness issue exists in the handling of QTVR movie files. (CVE-2012-0667)

- A buffer overflow exists in QuickTime's handling of Sorenson encoded movie files. (CVE-2012-0669)

- An integer overflow exists in QuickTime's handling of sean atoms. (CVE-2012-0670)

- A memory corruption issue exists in the handling of .pict files. (CVE-2012-0671)

Solution

Upgrade to QuickTime 7.7.2 or later.

Plugin Details

Severity: High

ID: 59113

File Name: quicktime_772.nasl

Version: 1.26

Type: local

Agent: windows

Family: Windows

Published: 5/16/2012

Updated: 11/15/2018

Dependencies: quicktime_installed.nasl

Risk Information

VPR

Risk Factor: High

Score: 8.9

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 8.1

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:H/RL:OF/RC:C

Vulnerability Information

CPE: cpe:2.3:a:apple:quicktime:*:*:*:*:*:*:*:*

Required KB Items: SMB/QuickTime/Version

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/15/2012

Vulnerability Publication Date: 5/15/2012

Exploitable With

Core Impact

Metasploit (Apple QuickTime TeXML Style Element Stack Buffer Overflow)

Reference Information

CVE: CVE-2012-0663, CVE-2012-0671, CVE-2012-0669, CVE-2012-0658, CVE-2012-0659, CVE-2011-3458, CVE-2012-0664, CVE-2012-0660, CVE-2011-3459, CVE-2011-3460, CVE-2012-0666, CVE-2012-0661, CVE-2012-0667, CVE-2012-0265, CVE-2012-0670, CVE-2012-0668, CVE-2012-0665

BID: 53579, 53582, 53584, 53571, 53465, 53467, 53469, 53574, 53576, 53577, 53578, 53580, 53583

EDB-ID: 19433