QuickTime < 7.7.2 Multiple Vulnerabilities

high Nessus Network Monitor Plugin ID 6489

Synopsis

The remote host contains an application that is vulnerable to multiple attack vectors.

Description

Versions of QuickTime earlier thanolder than 7.7.2 are affected by the following vulnerabilities :

 - An uninitialized memory access issue exists in the handling of MP4 encoded files. (CVE-2011-3458)

 - An off-by-one buffer overflow exists in the handling of rdrf atoms in QuickTime movie files. (CVE-2011-3459)

 - A stack buffer overflow exists in the QuickTime plugin's handling of PNG files. (CVE-2011-3460)

 - A stack buffer overflow exists in QuickTime's handling of file paths. (CVE-2012-0265)

 - A buffer overflow exists in the handling of audio sample tables. (CVE-2012-0658)

 - An integer overflow exists in the handling of MPEG files. (CVE-2012-0659)

 - An integer underflow exists in QuickTime's handling of audio streams in MPEG files. (CVE-2012-0660)

 - A use-after-free issue exists in the handling of JPEG2000 encoded movie files. (CVE-2012-0661)

 - Multiple stack overflows exist in QuickTime's handling of TeXML files. (CVE-2012-0663)

 - A heap overflow exists in QuickTime's handling of text tracks. (CVE-2012-0664)

 - A heap overflow exists in the handling of H.264 encoded movie files. (CVE-2012-0665)

 - A stack buffer overflow exists in the QuickTime plugin's handling of QTMovie objects. (CVE-2012-0666)

 - A signedness issue exists in the handling of QTVR movie files. (CVE-2012-0667)

 - A buffer overflow exists in QuickTime's handling of Sorenson encoded movie files. (CVE-2012-0669)

 - An integer overflow exists in QuickTime's handling of sean atoms. (CVE-2012-0670)

 - A memory corruption issue exists in the handling of .pict files. (CVE-2012-0671)

Solution

Upgrade to QuickTime 7.7.2 or later.

See Also

http://lists.apple.com/archives/security-announce/2012/May/msg00005.html

Plugin Details

Severity: High

ID: 6489

Family: Web Clients

Published: 5/18/2012

Updated: 3/6/2019

Nessus ID: 59113

Risk Information

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 6.9

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:2.3:a:apple:quicktime:*:*:*:*:*:*:*:*

Patch Publication Date: 5/15/2012

Vulnerability Publication Date: 5/15/2012

Exploitable With

Metasploit (Apple QuickTime TeXML Stack Buffer Overflow)

Reference Information

CVE: CVE-2012-0663, CVE-2012-0671, CVE-2012-0669, CVE-2012-0658, CVE-2012-0659, CVE-2011-3458, CVE-2012-0664, CVE-2012-0660, CVE-2011-3459, CVE-2011-3460, CVE-2012-0666, CVE-2012-0661, CVE-2012-0667, CVE-2012-0265, CVE-2012-0670, CVE-2012-0668, CVE-2012-0665

BID: 53579, 53582, 53584, 53571, 53465, 53467, 53469, 53574, 53576, 53577, 53578, 53580, 53583