Details of VAR-200705-0517

ID

VAR-200705-0517

CVE

CVE-2007-2389

TITLE

Apple QuickTime for Java information disclosure vulnerability

Trust: 0.8

sources: CERT/CC: VU#434748

DESCRIPTION

Apple QuickTime for Java 7.1.6 on Mac OS X and Windows does not clear potentially sensitive memory before use, which allows remote attackers to read memory from a web browser via unknown vectors related to Java applets. Apple QuickTime for Java fails to properly clear memory. As a result, sensitive information may be exposed to unintended parties. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Attackers may exploit this issue by convincing victims into visiting a malicious website. Exploiting this issue may allow remote attackers to view memory that may contain sensitive information. Apple QuickTime is a popular multimedia player that supports a wide variety of media formats. There is a loophole in QuickTime's Java Applet implementation, and a remote attacker may use this loophole to obtain sensitive information on the client. If a user is tricked into visiting a page containing a malicious Java Applet, this vulnerability may be triggered, resulting in the disclosure of sensitive information

Trust: 3.42

sources: NVD: CVE-2007-2389 // CERT/CC: VU#434748 // CERT/CC: VU#995836 // JVNDB: JVNDB-2007-001938 // BID: 24222 // VULHUB: VHN-25751

AFFECTED PRODUCTS

vendor:	apple computer	model:	-	scope:	-	version:	-	Trust: 1.6
vendor:	apple	model:	quicktime	scope:	eq	version:	7.1.6	Trust: 1.0
vendor:	apple	model:	mac os x	scope:	-	version:	-	Trust: 0.8
vendor:	apple	model:	quicktime	scope:	eq	version:	java edition 7.1.6	Trust: 0.8
vendor:	apple	model:	mac os x	scope:	eq	version:	10.3.6	Trust: 0.6
vendor:	apple	model:	mac os x	scope:	eq	version:	10.2.1	Trust: 0.6
vendor:	apple	model:	mac os x	scope:	eq	version:	10.3.4	Trust: 0.6
vendor:	apple	model:	mac os x	scope:	eq	version:	10.2	Trust: 0.6
vendor:	apple	model:	mac os x	scope:	eq	version:	10.2.4	Trust: 0.6
vendor:	apple	model:	mac os x	scope:	eq	version:	10.2.2	Trust: 0.6
vendor:	apple	model:	mac os x	scope:	eq	version:	10.3.3	Trust: 0.6
vendor:	apple	model:	mac os x	scope:	eq	version:	10.2.3	Trust: 0.6
vendor:	apple	model:	mac os x	scope:	eq	version:	10.3.2	Trust: 0.6
vendor:	apple	model:	mac os x	scope:	eq	version:	10.3.5	Trust: 0.6
vendor:	apple	model:	quicktime player	scope:	eq	version:	7.1.6	Trust: 0.3

sources: CERT/CC: VU#434748 // CERT/CC: VU#995836 // BID: 24222 // JVNDB: JVNDB-2007-001938 // CNNVD: CNNVD-200705-504 // NVD: CVE-2007-2389

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2007-2389
value:	HIGH
Trust: 1.0
CARNEGIE MELLON:	VU#434748
value:	2.97
Trust: 0.8
CARNEGIE MELLON:	VU#995836
value:	14.11
Trust: 0.8
NVD:	CVE-2007-2389
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-200705-504
value:	HIGH
Trust: 0.6
VULHUB:	VHN-25751
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2007-2389
severity:	HIGH
baseScore:	7.1
vectorString:	AV:N/AC:M/AU:N/C:C/I:N/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-25751
severity:	HIGH
baseScore:	7.1
vectorString:	AV:N/AC:M/AU:N/C:C/I:N/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: CERT/CC: VU#434748 // CERT/CC: VU#995836 // VULHUB: VHN-25751 // JVNDB: JVNDB-2007-001938 // CNNVD: CNNVD-200705-504 // NVD: CVE-2007-2389

PROBLEMTYPE DATA

problemtype:

NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2007-2389

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200705-504

TYPE

Design Error

Trust: 0.9

sources: BID: 24222 // CNNVD: CNNVD-200705-504

CONFIGURATIONS

sources: JVNDB: JVNDB-2007-001938

PATCH

title:

APPLE-SA-2007-05-29

url:

http://lists.apple.com/archives/security-announce/2007/May/msg00005.html

Trust: 0.8

sources: JVNDB: JVNDB-2007-001938

EXTERNAL IDS

db:	CERT/CC	id:	VU#434748	Trust: 3.6
db:	SECUNIA	id:	25130	Trust: 3.3
db:	NVD	id:	CVE-2007-2389	Trust: 2.8
db:	BID	id:	24222	Trust: 2.0
db:	OSVDB	id:	35575	Trust: 1.7
db:	SECTRACK	id:	1018136	Trust: 1.7
db:	VUPEN	id:	ADV-2007-1974	Trust: 1.7
db:	CERT/CC	id:	VU#995836	Trust: 0.8
db:	JVNDB	id:	JVNDB-2007-001938	Trust: 0.8
db:	XF	id:	34571	Trust: 0.6
db:	APPLE	id:	APPLE-SA-2007-05-29	Trust: 0.6
db:	CNNVD	id:	CNNVD-200705-504	Trust: 0.6
db:	VULHUB	id:	VHN-25751	Trust: 0.1

sources: CERT/CC: VU#434748 // CERT/CC: VU#995836 // VULHUB: VHN-25751 // BID: 24222 // JVNDB: JVNDB-2007-001938 // CNNVD: CNNVD-200705-504 // NVD: CVE-2007-2389

REFERENCES

url:	http://secunia.com/advisories/25130/	Trust: 3.2
url:	http://www.kb.cert.org/vuls/id/434748	Trust: 2.8
url:	http://docs.info.apple.com/article.html?artnum=305531	Trust: 1.9
url:	http://lists.apple.com/archives/security-announce/2007/may/msg00005.html	Trust: 1.7
url:	http://www.securityfocus.com/bid/24222	Trust: 1.7
url:	http://www.osvdb.org/35575	Trust: 1.7
url:	http://www.securitytracker.com/id?1018136	Trust: 1.7
url:	http://secunia.com/advisories/25130	Trust: 1.7
url:	http://docs.info.apple.com/article.html?artnum=304263	Trust: 1.6
url:	http://www.apple.com/support/downloads/	Trust: 1.6
url:	http://www.vupen.com/english/advisories/2007/1974	Trust: 1.1
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/34571	Trust: 1.1
url:	http://developer.apple.com/quicktime/qtjava/	Trust: 0.8
url:	http://developer.apple.com/quicktime/qtjava/	Trust: 0.8
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-2389	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-2389	Trust: 0.8
url:	http://xforce.iss.net/xforce/xfdb/34571	Trust: 0.6
url:	http://www.frsirt.com/english/advisories/2007/1974	Trust: 0.6
url:	http://software.cisco.com/download/navigator.html?mdfid=283613663	Trust: 0.3

sources: CERT/CC: VU#434748 // CERT/CC: VU#995836 // VULHUB: VHN-25751 // BID: 24222 // JVNDB: JVNDB-2007-001938 // CNNVD: CNNVD-200705-504 // NVD: CVE-2007-2389

CREDITS

Apple

Trust: 0.6

sources: CNNVD: CNNVD-200705-504

SOURCES

db:	CERT/CC	id:	VU#434748
db:	CERT/CC	id:	VU#995836
db:	VULHUB	id:	VHN-25751
db:	BID	id:	24222
db:	JVNDB	id:	JVNDB-2007-001938
db:	CNNVD	id:	CNNVD-200705-504
db:	NVD	id:	CVE-2007-2389

LAST UPDATE DATE

2025-04-10T23:01:14.587000+00:00

SOURCES UPDATE DATE

db:	CERT/CC	id:	VU#434748	date:	2007-05-30T00:00:00
db:	CERT/CC	id:	VU#995836	date:	2007-05-30T00:00:00
db:	VULHUB	id:	VHN-25751	date:	2017-07-29T00:00:00
db:	BID	id:	24222	date:	2007-05-30T20:01:00
db:	JVNDB	id:	JVNDB-2007-001938	date:	2012-06-26T00:00:00
db:	CNNVD	id:	CNNVD-200705-504	date:	2007-06-13T00:00:00
db:	NVD	id:	CVE-2007-2389	date:	2025-04-09T00:30:58.490

SOURCES RELEASE DATE

db:	CERT/CC	id:	VU#434748	date:	2007-05-30T00:00:00
db:	CERT/CC	id:	VU#995836	date:	2007-05-30T00:00:00
db:	VULHUB	id:	VHN-25751	date:	2007-05-29T00:00:00
db:	BID	id:	24222	date:	2007-05-29T00:00:00
db:	JVNDB	id:	JVNDB-2007-001938	date:	2012-06-26T00:00:00
db:	CNNVD	id:	CNNVD-200705-504	date:	2007-05-29T00:00:00
db:	NVD	id:	CVE-2007-2389	date:	2007-05-29T21:30:00