Sign-up

ID

VAR-200801-0012


CVE

CVE-2008-0033


TITLE

Apple QuickTime In Image Descriptor (IDSC) Atom analysis memory corruption vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2008-001037

DESCRIPTION

Unspecified vulnerability in Apple QuickTime before 7.4 allows remote attackers to cause a denial of service (application termination) and execute arbitrary code via a movie file with Image Descriptor (IDSC) atoms containing an invalid atom size, which triggers memory corruption. Apple QuickTime is prone to a memory-corruption vulnerability. An attacker can exploit this issue by enticing an unsuspecting user to open a specially crafted movie file. Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the user running the application. Failed exploit attempts likely result in denial-of-service conditions. This issue affects versions prior to Apple QuickTime 7.4 running on Microsoft Windows Vista, Microsoft Windows XP SP2, and Mac OS X. I. Description Apple QuickTime 7.4 resolves multiple vulnerabilities in the way different types of image and media files are handled. Note that Apple iTunes installs QuickTime, so any system with iTunes is vulnerable. II. For further information, please see About the security content of QuickTime 7.4. III. Solution Upgrade QuickTime Upgrade to QuickTime 7.4. This and other updates for Mac OS X are available via Apple Update. Secure your web browser To help mitigate these and other vulnerabilities that can be exploited via a web browser, refer to Securing Your Web Browser. References * About the security content of the QuickTime 7.4 Update - <http://docs.info.apple.com/article.html?artnum=307301> * How to tell if Software Update for Windows is working correctly when no updates are available - <http://docs.info.apple.com/article.html?artnum=304263> * Apple - QuickTime - Download - <http://www.apple.com/quicktime/download/> * Mac OS X: Updating your software - <http://docs.info.apple.com/article.html?artnum=106704> * Securing Your Web Browser - <http://www.us-cert.gov/reading_room/securing_browser/> _________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA08-016A.html> _________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA08-016A Feedback VU#818697" in the subject. _________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. _________________________________________________________________ Produced 2007 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> _________________________________________________________________ Revision History January 16, 2007: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBR45mevRFkHkM87XOAQLP6AgAj7J4sy83ZWEKfcDb2brgHptxAwqvArkZ HzV+5lGg1A86V4/MARlxXctWv5JH3e2knx5ZoMUN8napP9VEag2Ra68Zdh9lKu1S nfCRRwcIj38iakuv7xKrNt1AJHj3rHguzCjvWu8gHEJtlb15zqVr97Ci9LuNdLP3 W4hdsIxuzYQl7Ou5+j0Z9bhH1WWZRjmabsop+b0ApxeZI2F6mJn0rscRvxPQYBls ims6CP7YseK4+ElJHAMEJfW/6gPhwyedjgesd0jssYvhtYdufn4OCZvwL+p9QSlQ +E+UKcws4BHlEpg0dQhA13REQxwqqMgSWdm3NU8hbGdEJAJGH0cYNQ== =emKJ -----END PGP SIGNATURE----- . ---------------------------------------------------------------------- A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched. Download and test it today: https://psi.secunia.com/ Read more about this new version: https://psi.secunia.com/?page=changelog ---------------------------------------------------------------------- TITLE: Apple QuickTime Multiple Vulnerabilities SECUNIA ADVISORY ID: SA28502 VERIFY ADVISORY: http://secunia.com/advisories/28502/ CRITICAL: Highly critical IMPACT: System access WHERE: >From remote SOFTWARE: Apple QuickTime 7.x http://secunia.com/product/5090/ DESCRIPTION: Some vulnerabilities have been reported in Apple QuickTime, which can be exploited by malicious people to compromise a vulnerable system. 2) An error exists in the processing of Macintosh Resources embedded in QuickTime movies. This can be exploited to cause a memory corruption via an overly large length value stored in the resource header in a specially crafted QuickTime movie file. 3) An error in the parsing of malformed Image Descriptor (IDSC) atoms can be exploited to cause a heap corruption via a specially crafted movie file. 4) A boundary error exists within the processing of compressed PICT images and can be exploited to cause a buffer overflow. QuickTime 7.4 for Leopard: http://www.apple.com/support/downloads/quicktime74forleopard.html QuickTime 7.4 for Tiger: http://www.apple.com/support/downloads/quicktime74fortiger.html QuickTime 7.4 for Panther: http://www.apple.com/support/downloads/quicktime74forpanther.html QuickTime 7.4 for Windows: http://www.apple.com/support/downloads/quicktime74forwindows.html PROVIDED AND/OR DISCOVERED BY: 1) The vendor credits Joe Schottman of Virginia Tech 2) Jun Mao, VeriSign iDefense Labs. 3) Cody Pierce, TippingPoint DVLabs 4) The vendor credits Chris Ries, Carnegie Mellon University Computing Services ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=307301 TippingPoint DVLabs: http://dvlabs.tippingpoint.com/advisory/TPTI-08-01 iDefense Labs: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=642 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . Specifying a malicious atom size can result in an under allocated heap chunk and subsequently an exploitable heap corruption situation. -- Vendor Response: http://docs.info.apple.com/article.html?artnum=307301 -- Disclosure Timeline: 2007.10.19 - Vulnerability reported to vendor 2008.01.15 - Coordinated public release of advisory -- Credit: This vulnerability was discovered by Cody Pierce - TippingPoint DVLabs. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

Trust: 2.25

sources: NVD: CVE-2008-0033 // JVNDB: JVNDB-2008-001037 // BID: 27299 // VULHUB: VHN-30158 // PACKETSTORM: 62716 // PACKETSTORM: 62685 // PACKETSTORM: 62675

AFFECTED PRODUCTS

vendor:applemodel:quicktimescope:lteversion:7.3.1.70

Trust: 1.0

vendor:applemodel:quicktimescope:lteversion:7.3

Trust: 0.8

vendor:applemodel:quicktimescope:eqversion:7.3.1.70

Trust: 0.6

vendor:applemodel:quicktime playerscope:eqversion:7.1.6

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.1.5

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.1.4

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.1.3

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.1.2

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.1.1

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.0.4

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.0.3

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.0.2

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.0.1

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.0

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.3

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.2

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.1

Trust: 0.3

vendor:applemodel:quicktime playerscope:neversion:7.4

Trust: 0.3

sources: BID: 27299 // JVNDB: JVNDB-2008-001037 // CNNVD: CNNVD-200801-218 // NVD: CVE-2008-0033

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2008-0033
value: HIGH

Trust: 1.0

NVD: CVE-2008-0033
value: HIGH

Trust: 0.8

CNNVD: CNNVD-200801-218
value: CRITICAL

Trust: 0.6

VULHUB: VHN-30158
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2008-0033
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-30158
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-30158 // JVNDB: JVNDB-2008-001037 // CNNVD: CNNVD-200801-218 // NVD: CVE-2008-0033

PROBLEMTYPE DATA

problemtype:CWE-399

Trust: 1.9

sources: VULHUB: VHN-30158 // JVNDB: JVNDB-2008-001037 // NVD: CVE-2008-0033

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 62716 // CNNVD: CNNVD-200801-218

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-200801-218

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2008-001037

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-30158

PATCH
title:QuickTime 7.4url:http://docs.info.apple.com/article.html?artnum=307301-en
Trust: 0.8
title:QuickTime 7.4url:http://docs.info.apple.com/article.html?artnum=307301-ja
Trust: 0.8
title:TA08-016Aurl:http://software.fujitsu.com/jp/security/vulnerabilities/ta08-016a.html
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2008-001037

EXTERNAL IDS
db:NVDid:CVE-2008-0033
Trust: 2.9
db:BIDid:27299
Trust: 2.8
db:USCERTid:TA08-016A
Trust: 2.6
db:SECUNIAid:28502
Trust: 2.6
db:SECTRACKid:1019221
Trust: 2.5
db:VUPENid:ADV-2008-0148
Trust: 1.7
db:XFid:39697
Trust: 1.4
db:USCERTid:SA08-016A
Trust: 0.8
db:JVNDBid:JVNDB-2008-001037
Trust: 0.8
db:CNNVDid:CNNVD-200801-218
Trust: 0.7
db:BUGTRAQid:20080115 TPTI-08-01: APPLE QUICKTIME IMAGE FILE IDSC ATOM MEMORY CORRUPTION VULNERABILITY
Trust: 0.6
db:APPLEid:APPLE-SA-2008-01-15
Trust: 0.6
db:CERT/CCid:TA08-016A
Trust: 0.6
db:NSFOCUSid:11390
Trust: 0.6
db:PACKETSTORMid:62675
Trust: 0.2
db:VULHUBid:VHN-30158
Trust: 0.1
db:PACKETSTORMid:62716
Trust: 0.1
db:PACKETSTORMid:62685
Trust: 0.1
sources:
            
            
            VULHUB: VHN-30158 // 
            
            
            
            BID: 27299 // 
            
            
            
            JVNDB: JVNDB-2008-001037 // 
            
            
            
            PACKETSTORM: 62716 // 
            
            
            
            PACKETSTORM: 62685 // 
            
            
            
            PACKETSTORM: 62675 // 
            
            
            
            CNNVD: CNNVD-200801-218 // 
            
            
            
            NVD: CVE-2008-0033

REFERENCES
url:http://www.securityfocus.com/bid/27299
Trust: 2.5
url:http://www.us-cert.gov/cas/techalerts/ta08-016a.html
Trust: 2.5
url:http://www.securitytracker.com/id?1019221
Trust: 2.5
url:http://secunia.com/advisories/28502
Trust: 2.5
url:http://dvlabs.tippingpoint.com/advisory/tpti-08-01
Trust: 2.1
url:http://docs.info.apple.com/article.html?artnum=307301
Trust: 1.9
url:http://lists.apple.com/archives/security-announce/2008/jan/msg00001.html
Trust: 1.7
url:http://www.frsirt.com/english/advisories/2008/0148
Trust: 1.4
url:http://xforce.iss.net/xforce/xfdb/39697
Trust: 1.4
url:http://www.securityfocus.com/archive/1/486413/100/0/threaded
Trust: 1.1
url:http://www.vupen.com/english/advisories/2008/0148
Trust: 1.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/39697
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-0033
Trust: 0.8
url:http://jvn.jp/cert/jvnta08-016a/index.html
Trust: 0.8
url:http://jvn.jp/tr/trta08-016a
Trust: 0.8
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2008-0033
Trust: 0.8
url:http://www.us-cert.gov/cas/alerts/sa08-016a.html
Trust: 0.8
url:http://www.cyberpolice.go.jp/important/2008/20080117_135357.html
Trust: 0.8
url:http://www.securityfocus.com/archive/1/archive/1/486413/100/0/threaded
Trust: 0.6
url:http://www.nsfocus.net/vulndb/11390
Trust: 0.6
url:http://www.apple.com/quicktime/
Trust: 0.3
url:http://www.apple.com/swupdates/
Trust: 0.3
url:http://docs.info.apple.com/article.html?artnum=304263>
Trust: 0.1
url:http://www.apple.com/quicktime/download/>
Trust: 0.1
url:http://www.us-cert.gov/cas/techalerts/ta08-016a.html>
Trust: 0.1
url:http://www.us-cert.gov/legal.html>
Trust: 0.1
url:http://docs.info.apple.com/article.html?artnum=307301>
Trust: 0.1
url:http://docs.info.apple.com/article.html?artnum=106704>
Trust: 0.1
url:http://www.us-cert.gov/cas/signup.html>.
Trust: 0.1
url:http://www.us-cert.gov/reading_room/securing_browser/>
Trust: 0.1
url:http://www.apple.com/support/downloads/quicktime74forleopard.html
Trust: 0.1
url:http://www.apple.com/support/downloads/quicktime74forwindows.html
Trust: 0.1
url:http://secunia.com/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/product/5090/
Trust: 0.1
url:https://psi.secunia.com/?page=changelog
Trust: 0.1
url:https://psi.secunia.com/
Trust: 0.1
url:http://secunia.com/advisories/28502/
Trust: 0.1
url:http://www.apple.com/support/downloads/quicktime74fortiger.html
Trust: 0.1
url:http://www.apple.com/support/downloads/quicktime74forpanther.html
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=642
Trust: 0.1
url:http://secunia.com/about_secunia_advisories/
Trust: 0.1
url:http://www.zerodayinitiative.com/advisories/tpti-08-01.html
Trust: 0.1
url:http://secunia.com/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2008-0033
Trust: 0.1
url:http://lists.grok.org.uk/full-disclosure-charter.html
Trust: 0.1
sources:
            
            
            VULHUB: VHN-30158 // 
            
            
            
            BID: 27299 // 
            
            
            
            JVNDB: JVNDB-2008-001037 // 
            
            
            
            PACKETSTORM: 62716 // 
            
            
            
            PACKETSTORM: 62685 // 
            
            
            
            PACKETSTORM: 62675 // 
            
            
            
            CNNVD: CNNVD-200801-218 // 
            
            
            
            NVD: CVE-2008-0033

CREDITS
Cody Pierce
Trust: 0.7
sources:
            
            
            PACKETSTORM: 62675 // 
            
            
            
            CNNVD: CNNVD-200801-218

SOURCES
db:VULHUBid:VHN-30158
db:BIDid:27299
db:JVNDBid:JVNDB-2008-001037
db:PACKETSTORMid:62716
db:PACKETSTORMid:62685
db:PACKETSTORMid:62675
db:CNNVDid:CNNVD-200801-218
db:NVDid:CVE-2008-0033

LAST UPDATE DATE
2025-04-10T22:57:07.704000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-30158date:2018-10-15T00:00:00
db:BIDid:27299date:2008-01-16T18:18:00
db:JVNDBid:JVNDB-2008-001037date:2008-01-30T00:00:00
db:CNNVDid:CNNVD-200801-218date:2008-09-05T00:00:00
db:NVDid:CVE-2008-0033date:2025-04-09T00:30:58.490

SOURCES RELEASE DATE
db:VULHUBid:VHN-30158date:2008-01-16T00:00:00
db:BIDid:27299date:2008-01-15T00:00:00
db:JVNDBid:JVNDB-2008-001037date:2008-01-30T00:00:00
db:PACKETSTORMid:62716date:2008-01-17T05:49:01
db:PACKETSTORMid:62685date:2008-01-17T04:45:41
db:PACKETSTORMid:62675date:2008-01-16T05:52:04
db:CNNVDid:CNNVD-200801-218date:2008-01-15T00:00:00
db:NVDid:CVE-2008-0033date:2008-01-16T03:00:00