Details of VAR-201707-0421

ID

VAR-201707-0421

CVE

CVE-2017-2218

TITLE

Installer of QuickTime for Windows may insecurely load Dynamic Link Libraries

Trust: 0.8

sources: JVNDB: JVNDB-2017-000116

DESCRIPTION

Untrusted search path vulnerability in Installer of QuickTime for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. Yuji Tounai of NTT Communications Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.Arbitrary code may be executed with the privilege of the user invoking the installer. Apple QuickTime for Windows is a multimedia player software for Windows developed by Apple (Apple). The software is capable of handling multiple sources such as digital video, media segments, and more. Attackers can use malicious DLL files to exploit this vulnerability to gain permissions

Trust: 1.8

sources: NVD: CVE-2017-2218 // JVNDB: JVNDB-2017-000116 // VULHUB: VHN-110421 // VULMON: CVE-2017-2218

AFFECTED PRODUCTS

vendor:	apple	model:	quicktime	scope:	eq	version:	*	Trust: 1.0
vendor:	apple	model:	quicktime	scope:	eq	version:	for windows installer	Trust: 0.8
vendor:	apple	model:	quicktime	scope:	-	version:	-	Trust: 0.6

sources: JVNDB: JVNDB-2017-000116 // CNNVD: CNNVD-201707-352 // NVD: CVE-2017-2218

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-2218
value:	HIGH
Trust: 1.0
IPA:	JVNDB-2017-000116
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201707-352
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-110421
value:	MEDIUM
Trust: 0.1
VULMON:	CVE-2017-2218
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2017-2218
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.1
IPA:	JVNDB-2017-000116
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
VULHUB:	VHN-110421
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-2218
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.0
Trust: 1.0
IPA:	JVNDB-2017-000116
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-110421 // VULMON: CVE-2017-2218 // JVNDB: JVNDB-2017-000116 // CNNVD: CNNVD-201707-352 // NVD: CVE-2017-2218

PROBLEMTYPE DATA

problemtype:	CWE-426	Trust: 1.1
problemtype:	CWE-Other	Trust: 0.8

sources: VULHUB: VHN-110421 // JVNDB: JVNDB-2017-000116 // NVD: CVE-2017-2218

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201707-352

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201707-352

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-000116

PATCH

title:

QuickTime 7.7.9 for Windows

url:

https://support.apple.com/kb/DL837?locale=&viewlocale=en_US

Trust: 0.8

sources: JVNDB: JVNDB-2017-000116

EXTERNAL IDS

db:	JVN	id:	JVN94771799	Trust: 2.6
db:	NVD	id:	CVE-2017-2218	Trust: 2.6
db:	USCERT	id:	TA16-105A	Trust: 0.8
db:	JVNDB	id:	JVNDB-2017-000116	Trust: 0.8
db:	CNNVD	id:	CNNVD-201707-352	Trust: 0.7
db:	VULHUB	id:	VHN-110421	Trust: 0.1
db:	VULMON	id:	CVE-2017-2218	Trust: 0.1

sources: VULHUB: VHN-110421 // VULMON: CVE-2017-2218 // JVNDB: JVNDB-2017-000116 // CNNVD: CNNVD-201707-352 // NVD: CVE-2017-2218

REFERENCES

url:	https://jvn.jp/en/jp/jvn94771799/index.html	Trust: 2.6
url:	https://support.apple.com/kb/dl837?viewlocale=en_us	Trust: 1.8
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-2218	Trust: 0.8
url:	http://jvn.jp/en/ta/jvnta91240916/index.html	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-2218	Trust: 0.8
url:	https://www.us-cert.gov/ncas/alerts/ta16-105a	Trust: 0.8
url:	https://cwe.mitre.org/data/definitions/426.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULHUB: VHN-110421 // VULMON: CVE-2017-2218 // JVNDB: JVNDB-2017-000116 // CNNVD: CNNVD-201707-352 // NVD: CVE-2017-2218

SOURCES

db:	VULHUB	id:	VHN-110421
db:	VULMON	id:	CVE-2017-2218
db:	JVNDB	id:	JVNDB-2017-000116
db:	CNNVD	id:	CNNVD-201707-352
db:	NVD	id:	CVE-2017-2218

LAST UPDATE DATE

2025-04-20T23:36:49.516000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-110421	date:	2017-07-14T00:00:00
db:	VULMON	id:	CVE-2017-2218	date:	2017-07-14T00:00:00
db:	JVNDB	id:	JVNDB-2017-000116	date:	2018-02-14T00:00:00
db:	CNNVD	id:	CNNVD-201707-352	date:	2017-07-10T00:00:00
db:	NVD	id:	CVE-2017-2218	date:	2025-04-20T01:37:25.860

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-110421	date:	2017-07-07T00:00:00
db:	VULMON	id:	CVE-2017-2218	date:	2017-07-07T00:00:00
db:	JVNDB	id:	JVNDB-2017-000116	date:	2017-06-13T00:00:00
db:	CNNVD	id:	CNNVD-201707-352	date:	2017-07-10T00:00:00
db:	NVD	id:	CVE-2017-2218	date:	2017-07-07T13:29:00.647