Apple QuickTime for Java Unspecified Remote Heap Buffer Overflow Vulnerability
BID:24221
Info
Apple QuickTime for Java Unspecified Remote Heap Buffer Overflow Vulnerability
| Bugtraq ID: | 24221 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2007-2388 |
| Remote: | Yes |
| Local: | No |
| Published: | May 29 2007 12:00AM |
| Updated: | May 30 2007 04:01PM |
| Credit: | John McDonald, Paul Griswold, and Tom Cross of IBM Internet Security Systems X-Force, and Dyon Baldin of Secunia Research is credited with the discovery of this vulnerability. |
| Vulnerable: |
Apple QuickTime Player 7.1.6 |
| Not Vulnerable: | |
Discussion
Apple QuickTime for Java Unspecified Remote Heap Buffer Overflow Vulnerability
Apple QuickTime for Java is prone to a remote heap-based buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied input prior to copying it to an insufficiently sized buffer.
Exploiting this issue allows remote attackers to execute arbitrary machine code in the context of the affected application, facilitating the remote compromise of affected computers. Failed exploit attempts will result in a denial of service.
Apple QuickTime for Java is prone to a remote heap-based buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied input prior to copying it to an insufficiently sized buffer.
Exploiting this issue allows remote attackers to execute arbitrary machine code in the context of the affected application, facilitating the remote compromise of affected computers. Failed exploit attempts will result in a denial of service.
Exploit / POC
Apple QuickTime for Java Unspecified Remote Heap Buffer Overflow Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].
Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].
Solution / Fix
Apple QuickTime for Java Unspecified Remote Heap Buffer Overflow Vulnerability
Solution:
The vendor has released updates and an advisory to address this issue. Please see the references for more information.
Apple QuickTime Player 7.1.6
Solution:
The vendor has released updates and an advisory to address this issue. Please see the references for more information.
Apple QuickTime Player 7.1.6
-
Apple Security Update (QuickTime 7.1.6 for Mac)
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=14012&cat= 57&platform=osx&method=sa/SecUpdQuickTime716.dmg -
Apple Security Update (QuickTime 7.1.6 for Windows)
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=14013&cat= 57&platform=osx&method=sa/SecUpdQuickTime716.msi
References
Apple QuickTime for Java Unspecified Remote Heap Buffer Overflow Vulnerability
References:
References: