Apple QuickTime Sorenson 3 Video File Remote Memory Corruption Vulnerability
BID:35159
Info
Apple QuickTime Sorenson 3 Video File Remote Memory Corruption Vulnerability
| Bugtraq ID: | 35159 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2009-0188 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 01 2009 12:00AM |
| Updated: | Jun 02 2009 04:39PM |
| Credit: | Carsten Eiram of Secunia Research |
| Vulnerable: |
Apple QuickTime Player 7.6.1 Apple QuickTime Player 7.5.5 Apple QuickTime Player 7.4.5 Apple QuickTime Player 7.4.1 Apple QuickTime Player 7.3.1 .70 Apple QuickTime Player 7.3.1 Apple QuickTime Player 7.1.6 Apple QuickTime Player 7.1.5 Apple QuickTime Player 7.1.4 Apple QuickTime Player 7.1.3 Apple QuickTime Player 7.1.2 Apple QuickTime Player 7.1.1 Apple QuickTime Player 7.0.4 Apple QuickTime Player 7.0.3 Apple QuickTime Player 7.0.2 Apple QuickTime Player 7.0.1 Apple QuickTime Player 7.0 Apple QuickTime Player 6.5.2 Apple QuickTime Player 6.5.1 Apple QuickTime Player 6.5 Apple QuickTime Player 6.1 Apple QuickTime Player 5.0.2 Apple QuickTime Player 7.6 Apple QuickTime Player 7.5 Apple QuickTime Player 7.4 Apple QuickTime Player 7.4 Apple QuickTime Player 7.3 Apple QuickTime Player 7.2 Apple QuickTime Player 7.1 Apple QuickTime Player 6.4 Apple QuickTime Player 6 |
| Not Vulnerable: |
Apple QuickTime Player 7.6.2 |
Discussion
Apple QuickTime Sorenson 3 Video File Remote Memory Corruption Vulnerability
Apple QuickTime is prone to a memory-corruption vulnerability.
A remote attacker can exploit this issue by enticing an unsuspecting user to open a specially crafted file.
Successful exploits will allow the attacker to execute arbitrary code in the context of the user running the application. Failed exploit attempts likely result in denial-of-service conditions.
This issue affects Apple QuickTime running on Microsoft Windows Vista, Windows XP SP3, and Mac OS X.
Apple QuickTime is prone to a memory-corruption vulnerability.
A remote attacker can exploit this issue by enticing an unsuspecting user to open a specially crafted file.
Successful exploits will allow the attacker to execute arbitrary code in the context of the user running the application. Failed exploit attempts likely result in denial-of-service conditions.
This issue affects Apple QuickTime running on Microsoft Windows Vista, Windows XP SP3, and Mac OS X.
Exploit / POC
Apple QuickTime Sorenson 3 Video File Remote Memory Corruption Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Apple QuickTime Sorenson 3 Video File Remote Memory Corruption Vulnerability
Solution:
The vendor has released an update and an advisory. Please see the references for details.
Apple QuickTime Player 7.1
Apple QuickTime Player 7.3
Apple QuickTime Player 7.5
Apple QuickTime Player 7.6
Apple QuickTime Player 7.4
Apple QuickTime Player 6
Apple QuickTime Player 7.2
Apple QuickTime Player 7.4
Apple QuickTime Player 5.0.2
Apple QuickTime Player 6.1
Apple QuickTime Player 6.5
Apple QuickTime Player 6.5.1
Apple QuickTime Player 6.5.2
Apple QuickTime Player 7.0
Apple QuickTime Player 7.0.1
Apple QuickTime Player 7.0.2
Apple QuickTime Player 7.0.3
Apple QuickTime Player 7.0.4
Apple QuickTime Player 7.1.1
Apple QuickTime Player 7.1.2
Apple QuickTime Player 7.1.3
Apple QuickTime Player 7.1.4
Apple QuickTime Player 7.1.5
Apple QuickTime Player 7.1.6
Apple QuickTime Player 7.3.1 .70
Apple QuickTime Player 7.3.1
Apple QuickTime Player 7.4.1
Apple QuickTime Player 7.4.5
Apple QuickTime Player 7.5.5
Apple QuickTime Player 7.6.1
Solution:
The vendor has released an update and an advisory. Please see the references for details.
Apple QuickTime Player 7.1
-
Apple iTunes64Setup.exe
https://swdlp.apple.com/cgi-bin/WebObjects/SoftwareDownloadApp.woa/119 9/wo/LxvlN4m80bIbUwMImjaJ40/2.5 -
Apple iTunesSetup.exe
QuickTime 7.1.3 with iTunes for Windows 2000/XP
http://www.apple.com/quicktime/ -
Apple QuickTimeInstaller.exe
QuickTime 7.1.6 for Windows XP/2000
http://www.apple.com/quicktime/download/
Apple QuickTime Player 7.3
-
Apple iTunes64Setup.exe
https://swdlp.apple.com/cgi-bin/WebObjects/SoftwareDownloadApp.woa/119 9/wo/LxvlN4m80bIbUwMImjaJ40/2.5
Apple QuickTime Player 7.5
-
Apple iTunes64Setup.exe
https://swdlp.apple.com/cgi-bin/WebObjects/SoftwareDownloadApp.woa/119 9/wo/LxvlN4m80bIbUwMImjaJ40/2.5
Apple QuickTime Player 7.6
-
Apple QuickTime762_Leopard.dmg
For Mac OS X v10.5.7
http://www.apple.com/quicktime/download/ -
Apple QuickTime762_Tiger.dmg
For Mac OS X v10.4.11
http://www.apple.com/quicktime/download/ -
Apple iTunes64Setup.exe
https://swdlp.apple.com/cgi-bin/WebObjects/SoftwareDownloadApp.woa/119 9/wo/LxvlN4m80bIbUwMImjaJ40/2.5
Apple QuickTime Player 7.4
-
Apple iTunes64Setup.exe
https://swdlp.apple.com/cgi-bin/WebObjects/SoftwareDownloadApp.woa/119 9/wo/LxvlN4m80bIbUwMImjaJ40/2.5
Apple QuickTime Player 6
-
Apple iTunesSetup.exe
QuickTime 7.1.3 with iTunes for Windows 2000/XP
http://www.apple.com/quicktime/
Apple QuickTime Player 7.2
-
Apple iTunes64Setup.exe
https://swdlp.apple.com/cgi-bin/WebObjects/SoftwareDownloadApp.woa/119 9/wo/LxvlN4m80bIbUwMImjaJ40/2.5
Apple QuickTime Player 7.4
-
Apple iTunes64Setup.exe
https://swdlp.apple.com/cgi-bin/WebObjects/SoftwareDownloadApp.woa/119 9/wo/LxvlN4m80bIbUwMImjaJ40/2.5
Apple QuickTime Player 5.0.2
-
Apple iTunesSetup.exe
QuickTime 7.1.3 with iTunes for Windows 2000/XP
http://www.apple.com/quicktime/
Apple QuickTime Player 6.1
-
Apple iTunesSetup.exe
QuickTime 7.1.3 with iTunes for Windows 2000/XP
http://www.apple.com/quicktime/
Apple QuickTime Player 6.5
-
Apple iTunesSetup.exe
QuickTime 7.1.3 with iTunes for Windows 2000/XP
http://www.apple.com/quicktime/
Apple QuickTime Player 6.5.1
-
Apple iTunesSetup.exe
QuickTime 7.1.3 with iTunes for Windows 2000/XP
http://www.apple.com/quicktime/
Apple QuickTime Player 6.5.2
-
Apple iTunesSetup.exe
QuickTime 7.1.3 with iTunes for Windows 2000/XP
http://www.apple.com/quicktime/
Apple QuickTime Player 7.0
-
Apple iTunes64Setup.exe
https://swdlp.apple.com/cgi-bin/WebObjects/SoftwareDownloadApp.woa/119 9/wo/LxvlN4m80bIbUwMImjaJ40/2.5 -
Apple iTunesSetup.exe
QuickTime 7.1.3 with iTunes for Windows 2000/XP
http://www.apple.com/quicktime/
Apple QuickTime Player 7.0.1
-
Apple iTunes64Setup.exe
https://swdlp.apple.com/cgi-bin/WebObjects/SoftwareDownloadApp.woa/119 9/wo/LxvlN4m80bIbUwMImjaJ40/2.5 -
Apple iTunesSetup.exe
QuickTime 7.1.3 with iTunes for Windows 2000/XP
http://www.apple.com/quicktime/
Apple QuickTime Player 7.0.2
-
Apple iTunes64Setup.exe
https://swdlp.apple.com/cgi-bin/WebObjects/SoftwareDownloadApp.woa/119 9/wo/LxvlN4m80bIbUwMImjaJ40/2.5 -
Apple iTunesSetup.exe
QuickTime 7.1.3 with iTunes for Windows 2000/XP
http://www.apple.com/quicktime/
Apple QuickTime Player 7.0.3
-
Apple iTunes64Setup.exe
https://swdlp.apple.com/cgi-bin/WebObjects/SoftwareDownloadApp.woa/119 9/wo/LxvlN4m80bIbUwMImjaJ40/2.5 -
Apple iTunesSetup.exe
QuickTime 7.1.3 with iTunes for Windows 2000/XP
http://www.apple.com/quicktime/
Apple QuickTime Player 7.0.4
-
Apple iTunes64Setup.exe
https://swdlp.apple.com/cgi-bin/WebObjects/SoftwareDownloadApp.woa/119 9/wo/LxvlN4m80bIbUwMImjaJ40/2.5 -
Apple iTunesSetup.exe
QuickTime 7.1.3 with iTunes for Windows 2000/XP
http://www.apple.com/quicktime/
Apple QuickTime Player 7.1.1
-
Apple iTunes64Setup.exe
https://swdlp.apple.com/cgi-bin/WebObjects/SoftwareDownloadApp.woa/119 9/wo/LxvlN4m80bIbUwMImjaJ40/2.5 -
Apple QuickTimeInstaller.exe
QuickTime 7.1.6 for Windows XP/2000
http://www.apple.com/quicktime/download/
Apple QuickTime Player 7.1.2
-
Apple iTunes64Setup.exe
https://swdlp.apple.com/cgi-bin/WebObjects/SoftwareDownloadApp.woa/119 9/wo/LxvlN4m80bIbUwMImjaJ40/2.5 -
Apple QuickTimeInstaller.exe
QuickTime 7.1.6 for Windows XP/2000
http://www.apple.com/quicktime/download/
Apple QuickTime Player 7.1.3
-
Apple iTunes64Setup.exe
https://swdlp.apple.com/cgi-bin/WebObjects/SoftwareDownloadApp.woa/119 9/wo/LxvlN4m80bIbUwMImjaJ40/2.5 -
Apple QuickTimeInstaller.exe
QuickTime 7.1.6 for Windows XP/2000
http://www.apple.com/quicktime/download/
Apple QuickTime Player 7.1.4
-
Apple iTunes64Setup.exe
https://swdlp.apple.com/cgi-bin/WebObjects/SoftwareDownloadApp.woa/119 9/wo/LxvlN4m80bIbUwMImjaJ40/2.5 -
Apple QuickTimeInstaller.exe
QuickTime 7.1.6 for Windows XP/2000
http://www.apple.com/quicktime/download/
Apple QuickTime Player 7.1.5
-
Apple iTunes64Setup.exe
https://swdlp.apple.com/cgi-bin/WebObjects/SoftwareDownloadApp.woa/119 9/wo/LxvlN4m80bIbUwMImjaJ40/2.5 -
Apple QuickTimeInstaller.exe
QuickTime 7.1.6 for Windows XP/2000
http://www.apple.com/quicktime/download/
Apple QuickTime Player 7.1.6
-
Apple iTunes64Setup.exe
https://swdlp.apple.com/cgi-bin/WebObjects/SoftwareDownloadApp.woa/119 9/wo/LxvlN4m80bIbUwMImjaJ40/2.5
Apple QuickTime Player 7.3.1 .70
-
Apple iTunes64Setup.exe
https://swdlp.apple.com/cgi-bin/WebObjects/SoftwareDownloadApp.woa/119 9/wo/LxvlN4m80bIbUwMImjaJ40/2.5
Apple QuickTime Player 7.3.1
-
Apple iTunes64Setup.exe
https://swdlp.apple.com/cgi-bin/WebObjects/SoftwareDownloadApp.woa/119 9/wo/LxvlN4m80bIbUwMImjaJ40/2.5
Apple QuickTime Player 7.4.1
-
Apple iTunes64Setup.exe
https://swdlp.apple.com/cgi-bin/WebObjects/SoftwareDownloadApp.woa/119 9/wo/LxvlN4m80bIbUwMImjaJ40/2.5
Apple QuickTime Player 7.4.5
-
Apple iTunes64Setup.exe
https://swdlp.apple.com/cgi-bin/WebObjects/SoftwareDownloadApp.woa/119 9/wo/LxvlN4m80bIbUwMImjaJ40/2.5
Apple QuickTime Player 7.5.5
-
Apple iTunes64Setup.exe
https://swdlp.apple.com/cgi-bin/WebObjects/SoftwareDownloadApp.woa/119 9/wo/LxvlN4m80bIbUwMImjaJ40/2.5
Apple QuickTime Player 7.6.1
-
Apple QuickTime762_Leopard.dmg
For Mac OS X v10.5.7
http://www.apple.com/quicktime/download/ -
Apple QuickTime762_Tiger.dmg
For Mac OS X v10.4.11
http://www.apple.com/quicktime/download/ -
Apple iTunes64Setup.exe
https://swdlp.apple.com/cgi-bin/WebObjects/SoftwareDownloadApp.woa/119 9/wo/LxvlN4m80bIbUwMImjaJ40/2.5
References
Apple QuickTime Sorenson 3 Video File Remote Memory Corruption Vulnerability
References:
References:
- Apple QuickTime Homepage (Apple)
- Secunia Research: QuickTime Sorenson Video 3 Content Parsing Vulnerability (Secunia Research
) - About the security content of QuickTime 7.6.2 (Apple)