Sign-up

ID

VAR-201011-0160


CVE

CVE-2010-3792


TITLE

Apple Mac OS X of QuickTime Integer sign error vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2010-002436

DESCRIPTION

Integer signedness error in QuickTime in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted MPEG movie file. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The flaw exists within the quicktime.qtx. When handling the m1s atom an integer value is used as an offset into a buffer. Minimal validation is done and an attacker can supply a negative value. This can be used to write to an arbitrary address in process memory. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the user. This issue affects Apple Mac OS X 10.6 to 10.6.4 and Mac OS X Server 10.6 to 10.6.4. NOTE: This issue was previously covered in BID 44778 (Apple Mac OS X Prior to 10.6.5 Multiple Security Vulnerabilities), but has been given its own record to better document it. The flaw exists within the quicktime.qtx. -- Vendor Response: Apple states: Fixed in Mac OS X 10.6.5: http://support.apple.com/kb/HT4435 -- Disclosure Timeline: 2010-07-20 - Vulnerability reported to vendor 2010-11-10 - Coordinated public release of advisory -- Credit: This vulnerability was discovered by: * Anonymous -- About the Zero Day Initiative (ZDI): Established by TippingPoint, The Zero Day Initiative (ZDI) represents a best-of-breed model for rewarding security researchers for responsibly disclosing discovered vulnerabilities. Researchers interested in getting paid for their security research through the ZDI can find more information and sign-up at: http://www.zerodayinitiative.com The ZDI is unique in how the acquired vulnerability information is used. Instead, upon notifying the affected product vendor, TippingPoint provides its customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available. Furthermore, with the altruistic aim of helping to secure a broader user base, TippingPoint provides this vulnerability information confidentially to security vendors (including competitors) who have a vulnerability protection or mitigation product. Our vulnerability disclosure policy is available online at: http://www.zerodayinitiative.com/advisories/disclosure_policy/ Follow the ZDI on Twitter: http://twitter.com/thezdi

Trust: 2.7

sources: NVD: CVE-2010-3792 // JVNDB: JVNDB-2010-002436 // ZDI: ZDI-10-255 // BID: 44790 // VULHUB: VHN-46397 // PACKETSTORM: 95946

AFFECTED PRODUCTS

vendor:applemodel:quicktimescope: - version: -

Trust: 1.3

vendor:applemodel:mac os x serverscope:eqversion:10.6.2

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.6.0

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.6.3

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.6.3

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.6.2

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.6.0

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.6.1

Trust: 1.0

vendor:applemodel:quicktimescope:eqversion:*

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.6.4

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.6.1

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.6.4

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:v10.5.8

Trust: 0.8

vendor:applemodel:mac os xscope:eqversion:v10.6 to v10.6.4

Trust: 0.8

vendor:applemodel:mac os x serverscope:eqversion:v10.5.8

Trust: 0.8

vendor:applemodel:mac os x serverscope:eqversion:v10.6 to v10.6.4

Trust: 0.8

vendor:applemodel:quicktimescope:ltversion:7.6.9

Trust: 0.8

vendor:applemodel:quicktime playerscope:eqversion:7.6.8

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.6.7

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.6.6(1671)

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.6.6

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.6.5

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.6.4

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.6.2

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.6.1

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.64.17.73

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.6

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.6.4

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.6.3

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.6.2

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.6.1

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.6

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.6.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.6.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.6.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.6.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.6

Trust: 0.3

vendor:applemodel:quicktime playerscope:neversion:7.6.9

Trust: 0.3

vendor:applemodel:mac os serverscope:neversion:x10.6.5

Trust: 0.3

sources: ZDI: ZDI-10-255 // BID: 44790 // JVNDB: JVNDB-2010-002436 // CNNVD: CNNVD-201011-178 // NVD: CVE-2010-3792

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2010-3792
value: MEDIUM

Trust: 1.0

NVD: CVE-2010-3792
value: MEDIUM

Trust: 0.8

ZDI: CVE-2010-3792
value: HIGH

Trust: 0.7

CNNVD: CNNVD-201011-178
value: MEDIUM

Trust: 0.6

VULHUB: VHN-46397
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2010-3792
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

ZDI: CVE-2010-3792
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 8.5
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.7

VULHUB: VHN-46397
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: ZDI: ZDI-10-255 // VULHUB: VHN-46397 // JVNDB: JVNDB-2010-002436 // CNNVD: CNNVD-201011-178 // NVD: CVE-2010-3792

PROBLEMTYPE DATA

problemtype:CWE-189

Trust: 1.9

sources: VULHUB: VHN-46397 // JVNDB: JVNDB-2010-002436 // NVD: CVE-2010-3792

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 95946 // CNNVD: CNNVD-201011-178

TYPE

digital error

Trust: 0.6

sources: CNNVD: CNNVD-201011-178

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2010-002436

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-46397

PATCH
title:HT4435url:http://support.apple.com/kb/HT4435
Trust: 0.8
title:HT4447url:http://support.apple.com/kb/HT4447
Trust: 0.8
title:HT4435url:http://support.apple.com/kb/HT4435?viewlocale=ja_JP
Trust: 0.8
title:HT4447url:http://support.apple.com/kb/HT4447?viewlocale=ja_JP
Trust: 0.8
title:Fixed in Mac OS X 10.6.5:  7.6.9: http://support.apple.com/kb/HT4447url:http://support.apple.com/kb/HT4435QuickTime
Trust: 0.7
sources:
            
            
            ZDI: ZDI-10-255 // 
            
            
            
            JVNDB: JVNDB-2010-002436

EXTERNAL IDS
db:NVDid:CVE-2010-3792
Trust: 3.6
db:ZDIid:ZDI-10-255
Trust: 1.1
db:SECTRACKid:1024729
Trust: 1.1
db:JVNDBid:JVNDB-2010-002436
Trust: 0.8
db:ZDI_CANid:ZDI-CAN-839
Trust: 0.7
db:CNNVDid:CNNVD-201011-178
Trust: 0.7
db:APPLEid:APPLE-SA-2010-11-10-1
Trust: 0.6
db:BIDid:44790
Trust: 0.4
db:PACKETSTORMid:95946
Trust: 0.2
db:VULHUBid:VHN-46397
Trust: 0.1
sources:
            
            
            ZDI: ZDI-10-255 // 
            
            
            
            VULHUB: VHN-46397 // 
            
            
            
            BID: 44790 // 
            
            
            
            JVNDB: JVNDB-2010-002436 // 
            
            
            
            PACKETSTORM: 95946 // 
            
            
            
            CNNVD: CNNVD-201011-178 // 
            
            
            
            NVD: CVE-2010-3792

REFERENCES
url:http://support.apple.com/kb/ht4447
Trust: 1.8
url:http://support.apple.com/kb/ht4435
Trust: 1.8
url:http://lists.apple.com/archives/security-announce/2010//nov/msg00000.html
Trust: 1.7
url:http://lists.apple.com/archives/security-announce/2010//dec/msg00000.html
Trust: 1.1
url:http://www.securitytracker.com/id?1024729
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3792
Trust: 0.8
url:http://jvn.jp/cert/jvnvu331391
Trust: 0.8
url:http://jvn.jp/cert/jvnvu387412
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-3792
Trust: 0.8
url:http://support.apple.com/kb/ht4435quicktime
Trust: 0.7
url:http://www.zerodayinitiative.com/advisories/zdi-10-255
Trust: 0.4
url:http://www.apple.com/quicktime/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/disclosure_policy/
Trust: 0.1
url:http://twitter.com/thezdi
Trust: 0.1
url:http://www.tippingpoint.com
Trust: 0.1
url:http://www.zerodayinitiative.com
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2010-3792
Trust: 0.1
sources:
            
            
            ZDI: ZDI-10-255 // 
            
            
            
            VULHUB: VHN-46397 // 
            
            
            
            BID: 44790 // 
            
            
            
            JVNDB: JVNDB-2010-002436 // 
            
            
            
            PACKETSTORM: 95946 // 
            
            
            
            CNNVD: CNNVD-201011-178 // 
            
            
            
            NVD: CVE-2010-3792

CREDITS
Anonymous
Trust: 0.7
sources:
            
            
            ZDI: ZDI-10-255

SOURCES
db:ZDIid:ZDI-10-255
db:VULHUBid:VHN-46397
db:BIDid:44790
db:JVNDBid:JVNDB-2010-002436
db:PACKETSTORMid:95946
db:CNNVDid:CNNVD-201011-178
db:NVDid:CVE-2010-3792

LAST UPDATE DATE
2025-04-11T21:38:16.896000+00:00

SOURCES UPDATE DATE
db:ZDIid:ZDI-10-255date:2010-11-10T00:00:00
db:VULHUBid:VHN-46397date:2010-12-11T00:00:00
db:BIDid:44790date:2010-12-07T20:35:00
db:JVNDBid:JVNDB-2010-002436date:2010-12-17T00:00:00
db:CNNVDid:CNNVD-201011-178date:2010-11-18T00:00:00
db:NVDid:CVE-2010-3792date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:ZDIid:ZDI-10-255date:2010-11-10T00:00:00
db:VULHUBid:VHN-46397date:2010-11-16T00:00:00
db:BIDid:44790date:2010-11-10T00:00:00
db:JVNDBid:JVNDB-2010-002436date:2010-12-02T00:00:00
db:PACKETSTORMid:95946date:2010-11-18T01:09:35
db:CNNVDid:CNNVD-201011-178date:2010-11-18T00:00:00
db:NVDid:CVE-2010-3792date:2010-11-16T22:00:16.307