ID

VAR-200701-0596

CVE

CVE-2007-0015

TITLE

Apple QuickTime RTSP buffer overflow

DESCRIPTION

Buffer overflow in Apple QuickTime 7.1.3 allows remote attackers to execute arbitrary code via a long rtsp:// URI. Apple QuickTime is prone to a remote buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied input prior to copying it to an insufficiently sized stack-based memory buffer. Attackers exploit this issue by coercing targeted users to access malicious HTML or QTL files or by executing malicious JavaScript code. QuickTime 7.1.3 is vulnerable to this issue; other versions may also be affected. Apple QuickTime is a popular multimedia player that supports a wide variety of media formats. A remote attacker can construct something like \"rtsp://[any character]:[ > 256 bytes] The URL string of \" lures the user to click, and the overflow occurs when the system calls QuickTime processing, and any command of the attacker is executed. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA07-005A Apple QuickTime RTSP Buffer Overflow Original release date: January 05, 2007 Last revised: -- Source: US-CERT Systems Affected Apple QuickTime on systems running * Apple Mac OS X * Microsoft Windows Note that Apple iTunes and other software using the vulnerable QuickTime components are also affected. I. Public exploit code is available that demonstrates how opening a .QTL file triggers the buffer overflow. However, we have confirmed that other attack vectors for the vulnerability also exist. Possible attack vectors include * a web page that uses the QuickTime plug-in or ActiveX control * a web page that uses the rtsp:// protocol * a file that is associated with the QuickTime Player US-CERT is tracking this issue as VU#442497. This reference number corresponds to CVE-2007-0015. Note that this vulnerability affects QuickTime on Microsoft Windows and Apple Mac platforms. Although web pages can be used as attack vectors, this vulnerability is not dependent on the specific web browser that is used. II. III. Solution We are currently unaware of a solution to this problem. Until a solution becomes available, the workarounds provided in US-CERT Vulnerability Note VU#442497 are strongly encouraged. <http://www.kb.cert.org/vuls/id/442497> IV. References * US-CERT Vulnerability Note VU#442497 - <http://www.kb.cert.org/vuls/id/442497> * Securing Your Web Browser - <http://www.us-cert.gov/reading_room/securing_browser/> * CVE-2007-0015 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0015> ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA07-005A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA07-005A Feedback VU#442497" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2007 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History January 05, 2007: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBRZ7D9OxOF3G+ig+rAQLG+Af/e+VhtMJEDuzVbT47HRdINgIRiOceCx4u DZFbMaUvYu4hjGu9f+T6AaGWR9FQj1ZzWDYf/JHY67NCSkwJdFY4Th1vR09BXJGy lmAzlj7+l3U4UeR+rEud0ajP8qCO7vwRGP4rPUVkcqgaBXqdyfgQbNHtwIpw6w/z eFYyUp/2EA1vHeTGdPNAkQTupuC95kA0QsiONCVv9xTqg7xnlcXBTwKz+T/DcWig LDLgPMupim8+ruhkzCCOVveIFQPBdXN5Aem/Fvpmhi2V5HRBc65vKaDoLzBpt4BZ Wdbeud6ljPjm0JLPvy84Gn7qFcjCu3WP3Nayd7rhbClFZSWyGilM+Q== =RrHt -----END PGP SIGNATURE----- . ---------------------------------------------------------------------- Secunia is proud to announce the availability of the Secunia Software Inspector. The Secunia Software Inspector is a free service that detects insecure versions of software that you may have installed in your system. When insecure versions are detected, the Secunia Software Inspector also provides thorough guidelines for updating the software to the latest secure version from the vendor. This can be exploited to cause a stack-based buffer overflow via a specially crafted QTL file with an overly long (more than 256 bytes) "src" parameter (e.g. "rtsp://[any character]:[>256 bytes]"). SOLUTION: Do not open untrusted QTL files. PROVIDED AND/OR DISCOVERED BY: LMH ORIGINAL ADVISORY: http://projects.info-pull.com/moab/MOAB-01-01-2007.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

buffer overflow

CONFIGURATIONS

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

LMH lmh@info-pull.com

SOURCES

LAST UPDATE DATE

2025-04-10T23:20:03.744000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE