Apple QuickTime for Windows File System Permission Local Information Disclosure Vulnerability

Bugtraq ID:	45237
Class:	Design Error
CVE:	CVE-2010-0530
Remote:	No
Local:	Yes
Published:	Dec 07 2010 12:00AM
Updated:	Dec 07 2010 12:00AM
Credit:	Geoff Strickler of On-Line Transaction Consultants
Vulnerable:	Apple QuickTime Player 7.6.8 Apple QuickTime Player 7.6.7 Apple QuickTime Player 7.6.6 (1671) Apple QuickTime Player 7.6.6 Apple QuickTime Player 7.6.5 Apple QuickTime Player 7.6.4 Apple QuickTime Player 7.6.2 Apple QuickTime Player 7.6.1 Apple QuickTime Player 7.6
Not Vulnerable:	Apple QuickTime Player 7.6.9

Apple QuickTime for Windows File System Permission Local Information Disclosure Vulnerability

Apple QuickTime for Windows is prone to a local information-disclosure vulnerability.

A local attacker can exploit this issue to obtain sensitive information that may aid in further attacks.

Versions prior to Apple QuickTime 7.6.9 are vulnerable.

Apple QuickTime for Windows File System Permission Local Information Disclosure Vulnerability

A local attacker can exploit this issue through readily available tools.

Apple QuickTime for Windows File System Permission Local Information Disclosure Vulnerability

Solution:
Vendor fixes are available. Please see the referenced advisory for details.


Apple QuickTime Player 7.6.8

• Apple QuickTime769Leopard.dmg
  For Mac OS X v10.5.8
  http://www.apple.com/quicktime/download/


• Apple APPLE-SA-2010-12-07-1-QuickTimeInstaller.exe
  For Windows 7 / Vista / XP SP3
  http://www.apple.com/quicktime/download/

Apple QuickTime for Windows File System Permission Local Information Disclosure Vulnerability

References:

• Apple QuickTime Homepage (Apple)