Secunia Logo
 
Apple QuickTime Java Extension "toQTPointer()" Code Execution
Secunia Advisory: SA25011
Release Date: 2007-04-24
Last Update: 2007-05-03
Popularity: 24,352 views

Critical:
Highly critical
Impact: System access
Where: From remote
Solution Status: Vendor Patch

Software:Apple Quicktime 3.x
Apple Quicktime 4.x
Apple Quicktime 5.x
Apple Quicktime 6.x
Apple QuickTime 7.x

Binary Analysis: BA111 :: Available for 1 Credit

Subscribe: Instant alerts on relevant vulnerabilities

CVE reference:CVE-2007-2175


Description:
A vulnerability has been reported in Apple QuickTime, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an input validation error in "toQTPointer()" within the QuickTime Java extensions (QTJava.dll) and can be exploited to write arbitrary values to memory locations outside of an allocated buffer.

Successful exploitation allows execution of arbitrary code when a user visits a malicious web site using a Java-enabled browser e.g. Safari, Internet Explorer, or Firefox.

The vulnerability is reported on a Mac OS X system using Safari and Firefox. Other browsers and platforms may also be affected.

Solution:
Update to QuickTime version 7.1.6.

QuickTime 7.1.6 for Mac:
http://www.apple.com/support/downloads/quicktime716formac.html

QuickTime 7.1.6 for Windows:
http://www.apple.com/support/downloads/quicktime716forwindows.html

Provided and/or discovered by:
Dino Dai Zovi

Changelog:
2007-05-02: Updated "Description", "Title", and "Solution". Added links to "Original Advisory" section. Added CVE reference.
2007-05-03: Added link to US-CERT.

Original Advisory:
Apple:
http://docs.info.apple.com/article.html?artnum=305446

Matasano:
http://www.matasano.com/log/812/break...n-quicktime-affects-win32-apple-code/

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-07-023.html

Other References:
US-CERT VU#420668:
http://www.kb.cert.org/vuls/id/420668


Track this Secunia Advisory
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.

Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.

About this Secunia Advisory
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.

Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
  
Latest Advisories

Send Feedback to Secunia
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.

Ideas, suggestions, and other feedback are most welcome.

Most Popular - 3 Hours

1. Sun Java JDK / JRE Multiple Vulnerabilities // 114 views
2. VLC Media Player Real Demuxer Integer Overflow Vulnerability // 78 views
3. Microsoft Office Communications Server SIP INVITE Denial of Service // 66 views
4. Adobe Flash Player Multiple Security Issues and Vulnerabilities // 50 views
5. Mozilla Firefox 3 Multiple Vulnerabilities // 42 views
6. Lito Lite CMS "cid" SQL Injection Vulnerability // 38 views
7. Active eWebquiz "useremail" and "password" SQL Injection Vulnerabilities // 35 views
8. Basic PHP CMS "id" SQL Injection Vulnerability // 35 views
9. Active Photo Gallery "username" and "password" SQL Injection // 33 views
10. RakhiSoftware Shopping Cart Multiple Vulnerabilities // 33 views