Apple QuickTime 'QuickTimePlayer.dll' ActiveX Buffer Overflow Vulnerability

Bugtraq ID:	49465
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 06 2011 12:00AM
Updated:	Sep 06 2011 12:00AM
Credit:	Ivan Sanchez & Hernan Hegykozi
Vulnerable:	Apple QuickTime Player 7.6.9
Not Vulnerable:

Apple QuickTime 'QuickTimePlayer.dll' ActiveX Buffer Overflow Vulnerability

Apple QuickTime is prone to a buffer-overflow vulnerability because of a failure to properly bounds-check user-supplied data.

Successful exploits will allow attackers to execute arbitrary code in the context of the currently logged-in user; failed exploit attempts may cause denial-of-service conditions.

QuickTime 7.6.9 is vulnerable; other versions may also be affected.

Apple QuickTime 'QuickTimePlayer.dll' ActiveX Buffer Overflow Vulnerability

The following proof of concept is available:

• /data/vulnerabilities/exploits/49465.html

Apple QuickTime 'QuickTimePlayer.dll' ActiveX Buffer Overflow Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apple QuickTime 'QuickTimePlayer.dll' ActiveX Buffer Overflow Vulnerability

References:

• Apple QuickTime Homepage (Apple)
  
• Microsoft Support Document 240797 (Microsoft)
  
• Quick Time Player 7.6.9 �?? ActiveX Control Buffer Overflow Vulnerability (Evilcode)