var-200605-0222
Vulnerability from variot
Heap-based buffer overflow in Apple QuickTime before 7.1 allows remote attackers to execute arbitrary code via a H.264 (M4V) video format file with a certain modified size value. The implicit trust of a user-supplied size value during a memory copy loop allows an attacker to create an exploitable memory corruption condition. Exploitation requires that an attacker either coerce the target to open a malformed media file or visit a website embedding the malicious file. Multiple integer-overflow and buffer-overflow vulnerabilities affect QuickTime. These issues affect both Mac OS X and Microsoft Windows releases of the software. Successful exploits will result in the execution of arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely cause denial-of-service conditions. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
National Cyber Alert System
Technical Cyber Security Alert TA06-132B
Apple QuickTime Vulnerabilities
Original release date: May 12, 2006 Last revised: -- Source: US-CERT
Systems Affected
Apple QuickTime on systems running
* Apple Mac OS X
* Microsoft Windows
Overview
Apple QuickTime contains multiple vulnerabilities.
I. Description
Apple QuickTime 7.1 resolves multiple vulnerabilities in the way different types of image and media files are handled. An attacker could exploit these vulnerabilities by convincing a user to access a specially crafted image or media file with a vulnerable version of QuickTime. Since QuickTime configures most web browsers to handle QuickTime media files, an attacker could exploit these vulnerabilities using a web page.
For more information, please refer to the Vulnerability Notes.
II. Impact
The impacts of these vulnerabilities could allow an remote, unauthenticated attacker to execute arbitrary code or commands, and cause a denial-of-service condition. For further information, please see the Vulnerability Notes.
III.
Disable QuickTime in your web browser
An attacker may be able to exploit this vulnerability by persuading a user to access a specially crafted file with a web browser. Disabling QuickTime in your web browser will defend against this attack vector. For more information, refer to the Securing Your Web Browser document.
Appendix A. References
* Vulnerability Notes for QuickTime 7.1 -
<http://www.kb.cert.org/vuls/byid?searchview&query=QuickTime_7.1>
* Securing Your Web Browser -
<http://www.us-cert.gov/reading_room/securing_browser/>
* About the security content of the QuickTime 7.1 Update -
<http://docs.info.apple.com/article.html?artnum=303752>
* Apple QuickTime 7.1 -
<http://www.apple.com/support/downloads/quicktime71.html>
* Standalone Apple QuickTime Player -
<http://www.apple.com/quicktime/download/standalone.html>
* Mac OS X: Updating your software -
<http://docs.info.apple.com/article.html?artnum=106704>
The most recent version of this document can be found at:
<http://www.us-cert.gov/cas/techalerts/TA06-132B.html>
Feedback can be directed to US-CERT Technical Staff. Please send email to cert@cert.org with "TA06-132B Feedback VU#289705" in the subject.
For instructions on subscribing to or unsubscribing from this mailing list, visit http://www.us-cert.gov/cas/signup.html.
Produced 2006 by US-CERT, a government organization.
Terms of use:
<http://www.us-cert.gov/legal.html>
Revision History
May 12, 2006: Initial release
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux)
iQEVAwUBRGT7JH0pj593lg50AQI2Uwf/U3zGDrR8UkWK4ry6AYMS7HPMdbiF6Vmo 9gP9Luc6Kj8zzxCWhnNKNzEq2P0B1oD03WcPFaIPnwvQJGApeUDRimyhQj8RDjME yAUt/reWG7RZ0Z2w/qaiZP7pQ7SjyIUKkN2OCG8LMmGKqsiCdFXoss/Bu0yFMH11 uvgwibfvkOdRLAPmRTVWk+gJEAdw3xFySm9r92qmig6CxKi7GAIpi9Gf7MXcRsKg oG3y5f06Kiq8ACYszPKneHE7WNvLP1ewuaWmf7PHiNebAB+W5hfwA2yEh6e6PSV2 eBi5cpigfXBrsjXk4L7wYrD8UcRl7nN8iqzWpMwYJkSloUmcYL1BBg== =LsFu -----END PGP SIGNATURE----- . ZDI-06-015: Apple QuickTime H.264 Parsing Heap Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-06-015.html May 11, 2006
-- CVE ID: CVE-2006-1463
-- Affected Vendor: Apple
-- Affected Products: Apple QuickTime versions prior to 7.1
-- TippingPoint(TM) IPS Customer Protection: TippingPoint IPS customers have been protected against this vulnerability since March 20, 2006 by Digital Vaccine protection filter ID 4183.
-- Vendor Response: Apple has identified and corrected this issue in QuickTime 7.1. Customers can obtain the fix from Apple's Software Downloads web site:
http://www.apple.com/support/downloads/
For further details see:
http://docs.info.apple.com/article.html?artnum=61798
-- Disclosure Timeline: 2006.03.20 - Vulnerability reported to vendor 2006.03.20 - Digital Vaccine released to TippingPoint customers 2006.05.11 - Coordinated public release of advisory
-- Credit: This vulnerability was discovered by ATmaCA.
-- About the Zero Day Initiative (ZDI): Established by TippingPoint, a division of 3Com, The Zero Day Initiative (ZDI) represents a best-of-breed model for rewarding security researchers for responsibly disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is used. 3Com does not re-sell the vulnerability details or any exploit code. Instead, upon notifying the affected product vendor, 3Com provides its customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available. Furthermore, with the altruistic aim of helping to secure a broader user base, 3Com provides this vulnerability information confidentially to security vendors (including competitors) who have a vulnerability protection or mitigation product.
TITLE: QuickTime Multiple Code Execution Vulnerabilities
SECUNIA ADVISORY ID: SA20069
VERIFY ADVISORY: http://secunia.com/advisories/20069/
CRITICAL: Highly critical
IMPACT: DoS, System access
WHERE:
From remote
SOFTWARE: Apple Quicktime 4.x http://secunia.com/product/7923/ Apple Quicktime 5.x http://secunia.com/product/215/ Apple Quicktime 6.x http://secunia.com/product/810/ Apple QuickTime 7.x http://secunia.com/product/5090/
DESCRIPTION: Multiple vulnerabilities have been reported in QuickTime, which can be exploited by malicious people to compromise a user's system.
1) An integer overflow error within the processing of JPEG images can be exploited via a specially crafted JPEG image to crash the application and potentially execute arbitrary code.
3) A boundary error within the processing of Flash movies can be exploited via a specially crafted Flash movie to crash the application and potentially execute arbitrary code.
5) A boundary error within the processing of MPEG4 movies can be exploited via a specially crafted MPEG4 movie to crash the application and potentially execute arbitrary code.
6) An integer overflow error within the processing of FlashPix images (".fpx") can be exploited via a specially crafted FlashPix image with an overly large value in the field specifying the number of data blocks in the file.
7) A boundary error within the processing of AVI movies can be exploited via a specially crafted AVI movie to crash the application and potentially execute arbitrary code.
8) Two boundary errors within the processing of PICT images can be exploited to either cause a stack-based via a PICT image with specially crafted font information or a heap-based buffer overflow via a PICT image with specially crafted image data. This can be exploited to crash the application and potentially execute arbitrary code.
9) A boundary error within the processing of BMP images can be exploited via a specially crafted BMP image to crash the application and potentially execute arbitrary code.
SOLUTION: Update to version 7.1. http://www.apple.com/support/downloads/quicktime71.html
PROVIDED AND/OR DISCOVERED BY: 1) Reported by the vendor. 2) Mike Price of McAfee AVERT Labs and Sowhat of Nevis Labs. 3) Mike Price, McAfee AVERT Labs. 4) Mike Price of McAfee AVERT Labs and ATmaCA. 5) Mike Price, McAfee AVERT Labs. 6) Fang Xing of eEye Digital Security and Mike Price of McAfee AVERT Labs. 7) Mike Price, McAfee AVERT Labs. 8) Mike Price, McAfee AVERT Labs. 9) Tom Ferris
ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=303752
eEye Digital Security: http://www.eeye.com/html/research/advisories/AD20060511.html
Zero Day Initiative: http://www.zerodayinitiative.com/advisories/ZDI-06-015.html
Sowhat: http://secway.org/advisory/AD20060512.txt
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200605-0222",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "quicktime",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "7.0.4"
},
{
"model": "quicktime",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "7.0.3"
},
{
"model": "quicktime",
"scope": null,
"trust": 0.7,
"vendor": "apple",
"version": null
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.4"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.3"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.2"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.1"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.5.2"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.5.1"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.5"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.1"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6"
},
{
"model": "quicktime player",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "7.1"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-06-015"
},
{
"db": "BID",
"id": "17953"
},
{
"db": "CNNVD",
"id": "CNNVD-200605-255"
},
{
"db": "NVD",
"id": "CVE-2006-1463"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "ATmaCA",
"sources": [
{
"db": "ZDI",
"id": "ZDI-06-015"
}
],
"trust": 0.7
},
"cve": "CVE-2006-1463",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 4.9,
"id": "CVE-2006-1463",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.0,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 4.9,
"id": "VHN-17571",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:H/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2006-1463",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-200605-255",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-17571",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-17571"
},
{
"db": "CNNVD",
"id": "CNNVD-200605-255"
},
{
"db": "NVD",
"id": "CVE-2006-1463"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Heap-based buffer overflow in Apple QuickTime before 7.1 allows remote attackers to execute arbitrary code via a H.264 (M4V) video format file with a certain modified size value. The implicit trust of a user-supplied size value during a memory copy loop allows an attacker to create an exploitable memory corruption condition. Exploitation requires that an attacker either coerce the target to open a malformed media file or visit a website embedding the malicious file. Multiple integer-overflow and buffer-overflow vulnerabilities affect QuickTime. These issues affect both Mac OS X and Microsoft Windows releases of the software. \nSuccessful exploits will result in the execution of arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely cause denial-of-service conditions. \n-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n\n National Cyber Alert System\n\n Technical Cyber Security Alert TA06-132B\n\n\nApple QuickTime Vulnerabilities\n\n Original release date: May 12, 2006\n Last revised: --\n Source: US-CERT\n\n\nSystems Affected\n\n Apple QuickTime on systems running\n\n * Apple Mac OS X\n * Microsoft Windows\n\n\nOverview\n\n Apple QuickTime contains multiple vulnerabilities. \n\n\nI. Description\n\n Apple QuickTime 7.1 resolves multiple vulnerabilities in the way\n different types of image and media files are handled. An attacker\n could exploit these vulnerabilities by convincing a user to access\n a specially crafted image or media file with a vulnerable version\n of QuickTime. Since QuickTime configures most web browsers to\n handle QuickTime media files, an attacker could exploit these\n vulnerabilities using a web page. \n\n For more information, please refer to the Vulnerability Notes. \n\n\nII. Impact\n\n The impacts of these vulnerabilities could allow an remote,\n unauthenticated attacker to execute arbitrary code or commands, and\n cause a denial-of-service condition. For further information,\n please see the Vulnerability Notes. \n\n\nIII. \n\nDisable QuickTime in your web browser\n\n An attacker may be able to exploit this vulnerability by persuading\n a user to access a specially crafted file with a web\n browser. Disabling QuickTime in your web browser will defend\n against this attack vector. For more information, refer to the\n Securing Your Web Browser document. \n\n\nAppendix A. References\n\n * Vulnerability Notes for QuickTime 7.1 -\n \u003chttp://www.kb.cert.org/vuls/byid?searchview\u0026query=QuickTime_7.1\u003e\n \n * Securing Your Web Browser -\n \u003chttp://www.us-cert.gov/reading_room/securing_browser/\u003e\n \n * About the security content of the QuickTime 7.1 Update -\n \u003chttp://docs.info.apple.com/article.html?artnum=303752\u003e\n \n * Apple QuickTime 7.1 -\n \u003chttp://www.apple.com/support/downloads/quicktime71.html\u003e\n \n * Standalone Apple QuickTime Player -\n \u003chttp://www.apple.com/quicktime/download/standalone.html\u003e\n \n * Mac OS X: Updating your software -\n \u003chttp://docs.info.apple.com/article.html?artnum=106704\u003e\n\n\n ____________________________________________________________________\n\n The most recent version of this document can be found at:\n\n \u003chttp://www.us-cert.gov/cas/techalerts/TA06-132B.html\u003e\n ____________________________________________________________________\n\n Feedback can be directed to US-CERT Technical Staff. Please send\n email to \u003ccert@cert.org\u003e with \"TA06-132B Feedback VU#289705\" in the\n subject. \n ____________________________________________________________________\n\n For instructions on subscribing to or unsubscribing from this\n mailing list, visit \u003chttp://www.us-cert.gov/cas/signup.html\u003e. \n ____________________________________________________________________\n\n Produced 2006 by US-CERT, a government organization. \n\n Terms of use:\n\n \u003chttp://www.us-cert.gov/legal.html\u003e\n ____________________________________________________________________\n\n\nRevision History\n\n May 12, 2006: Initial release\n\n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.2.1 (GNU/Linux)\n\niQEVAwUBRGT7JH0pj593lg50AQI2Uwf/U3zGDrR8UkWK4ry6AYMS7HPMdbiF6Vmo\n9gP9Luc6Kj8zzxCWhnNKNzEq2P0B1oD03WcPFaIPnwvQJGApeUDRimyhQj8RDjME\nyAUt/reWG7RZ0Z2w/qaiZP7pQ7SjyIUKkN2OCG8LMmGKqsiCdFXoss/Bu0yFMH11\nuvgwibfvkOdRLAPmRTVWk+gJEAdw3xFySm9r92qmig6CxKi7GAIpi9Gf7MXcRsKg\noG3y5f06Kiq8ACYszPKneHE7WNvLP1ewuaWmf7PHiNebAB+W5hfwA2yEh6e6PSV2\neBi5cpigfXBrsjXk4L7wYrD8UcRl7nN8iqzWpMwYJkSloUmcYL1BBg==\n=LsFu\n-----END PGP SIGNATURE-----\n. ZDI-06-015: Apple QuickTime H.264 Parsing Heap Overflow Vulnerability\nhttp://www.zerodayinitiative.com/advisories/ZDI-06-015.html\nMay 11, 2006\n\n-- CVE ID:\nCVE-2006-1463\n\n-- Affected Vendor:\nApple\n\n-- Affected Products:\nApple QuickTime versions prior to 7.1\n\n-- TippingPoint(TM) IPS Customer Protection:\nTippingPoint IPS customers have been protected against this\nvulnerability since March 20, 2006 by Digital Vaccine protection\nfilter ID 4183. \n\n-- Vendor Response:\nApple has identified and corrected this issue in QuickTime 7.1. \nCustomers can obtain the fix from Apple\u0027s Software Downloads web site:\n\n http://www.apple.com/support/downloads/\n\nFor further details see:\n\n http://docs.info.apple.com/article.html?artnum=61798\n\n-- Disclosure Timeline:\n2006.03.20 - Vulnerability reported to vendor\n2006.03.20 - Digital Vaccine released to TippingPoint customers\n2006.05.11 - Coordinated public release of advisory\n\n-- Credit:\nThis vulnerability was discovered by ATmaCA. \n\n-- About the Zero Day Initiative (ZDI):\nEstablished by TippingPoint, a division of 3Com, The Zero Day Initiative\n(ZDI) represents a best-of-breed model for rewarding security\nresearchers for responsibly disclosing discovered vulnerabilities. \n\nResearchers interested in getting paid for their security research\nthrough the ZDI can find more information and sign-up at:\n\n http://www.zerodayinitiative.com\n\nThe ZDI is unique in how the acquired vulnerability information is used. \n3Com does not re-sell the vulnerability details or any exploit code. \nInstead, upon notifying the affected product vendor, 3Com provides its\ncustomers with zero day protection through its intrusion prevention\ntechnology. Explicit details regarding the specifics of the\nvulnerability are not exposed to any parties until an official vendor\npatch is publicly available. Furthermore, with the altruistic aim of\nhelping to secure a broader user base, 3Com provides this vulnerability\ninformation confidentially to security vendors (including competitors)\nwho have a vulnerability protection or mitigation product. \n\nTITLE:\nQuickTime Multiple Code Execution Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA20069\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/20069/\n\nCRITICAL:\nHighly critical\n\nIMPACT:\nDoS, System access\n\nWHERE:\n\u003eFrom remote\n\nSOFTWARE:\nApple Quicktime 4.x\nhttp://secunia.com/product/7923/\nApple Quicktime 5.x\nhttp://secunia.com/product/215/\nApple Quicktime 6.x\nhttp://secunia.com/product/810/\nApple QuickTime 7.x\nhttp://secunia.com/product/5090/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in QuickTime, which can\nbe exploited by malicious people to compromise a user\u0027s system. \n\n1) An integer overflow error within the processing of JPEG images can\nbe exploited via a specially crafted JPEG image to crash the\napplication and potentially execute arbitrary code. \n\n3) A boundary error within the processing of Flash movies can be\nexploited via a specially crafted Flash movie to crash the\napplication and potentially execute arbitrary code. \n\n5) A boundary error within the processing of MPEG4 movies can be\nexploited via a specially crafted MPEG4 movie to crash the\napplication and potentially execute arbitrary code. \n\n6) An integer overflow error within the processing of FlashPix images\n(\".fpx\") can be exploited via a specially crafted FlashPix image with\nan overly large value in the field specifying the number of data\nblocks in the file. \n\n7) A boundary error within the processing of AVI movies can be\nexploited via a specially crafted AVI movie to crash the application\nand potentially execute arbitrary code. \n\n8) Two boundary errors within the processing of PICT images can be\nexploited to either cause a stack-based via a PICT image with\nspecially crafted font information or a heap-based buffer overflow\nvia a PICT image with specially crafted image data. This can be\nexploited to crash the application and potentially execute arbitrary\ncode. \n\n9) A boundary error within the processing of BMP images can be\nexploited via a specially crafted BMP image to crash the application\nand potentially execute arbitrary code. \n\nSOLUTION:\nUpdate to version 7.1. \nhttp://www.apple.com/support/downloads/quicktime71.html\n\nPROVIDED AND/OR DISCOVERED BY:\n1) Reported by the vendor. \n2) Mike Price of McAfee AVERT Labs and Sowhat of Nevis Labs. \n3) Mike Price, McAfee AVERT Labs. \n4) Mike Price of McAfee AVERT Labs and ATmaCA. \n5) Mike Price, McAfee AVERT Labs. \n6) Fang Xing of eEye Digital Security and Mike Price of McAfee AVERT\nLabs. \n7) Mike Price, McAfee AVERT Labs. \n8) Mike Price, McAfee AVERT Labs. \n9) Tom Ferris\n\nORIGINAL ADVISORY:\nApple:\nhttp://docs.info.apple.com/article.html?artnum=303752\n\neEye Digital Security:\nhttp://www.eeye.com/html/research/advisories/AD20060511.html\n\nZero Day Initiative:\nhttp://www.zerodayinitiative.com/advisories/ZDI-06-015.html\n\nSowhat:\nhttp://secway.org/advisory/AD20060512.txt\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2006-1463"
},
{
"db": "ZDI",
"id": "ZDI-06-015"
},
{
"db": "BID",
"id": "17953"
},
{
"db": "VULHUB",
"id": "VHN-17571"
},
{
"db": "PACKETSTORM",
"id": "46427"
},
{
"db": "PACKETSTORM",
"id": "46409"
},
{
"db": "PACKETSTORM",
"id": "46260"
}
],
"trust": 2.16
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-17571",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-17571"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2006-1463",
"trust": 2.8
},
{
"db": "ZDI",
"id": "ZDI-06-015",
"trust": 2.6
},
{
"db": "BID",
"id": "17953",
"trust": 2.0
},
{
"db": "SECUNIA",
"id": "20069",
"trust": 1.9
},
{
"db": "USCERT",
"id": "TA06-132B",
"trust": 1.8
},
{
"db": "SREASON",
"id": "888",
"trust": 1.7
},
{
"db": "SECTRACK",
"id": "1016067",
"trust": 1.7
},
{
"db": "VUPEN",
"id": "ADV-2006-1778",
"trust": 1.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-033",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-200605-255",
"trust": 0.7
},
{
"db": "APPLE",
"id": "APPLE-SA-2006-05-11",
"trust": 0.6
},
{
"db": "CERT/CC",
"id": "TA06-132B",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20060511 ZDI-06-015: APPLE QUICKTIME H.264 PARSING HEAP OVERFLOW VULNERABILITY",
"trust": 0.6
},
{
"db": "XF",
"id": "264",
"trust": 0.6
},
{
"db": "XF",
"id": "26396",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "46409",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-17571",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "46427",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "46260",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-06-015"
},
{
"db": "VULHUB",
"id": "VHN-17571"
},
{
"db": "BID",
"id": "17953"
},
{
"db": "PACKETSTORM",
"id": "46427"
},
{
"db": "PACKETSTORM",
"id": "46409"
},
{
"db": "PACKETSTORM",
"id": "46260"
},
{
"db": "CNNVD",
"id": "CNNVD-200605-255"
},
{
"db": "NVD",
"id": "CVE-2006-1463"
}
]
},
"id": "VAR-200605-0222",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-17571"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T20:41:59.988000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Apple has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "http://www.apple.com/support/downloads/"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-06-015"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-17571"
},
{
"db": "NVD",
"id": "CVE-2006-1463"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.9,
"url": "http://www.zerodayinitiative.com/advisories/zdi-06-015.html"
},
{
"trust": 1.7,
"url": "http://lists.apple.com/archives/security-announce/2006/may/msg00002.html"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/17953"
},
{
"trust": 1.7,
"url": "http://www.us-cert.gov/cas/techalerts/ta06-132b.html"
},
{
"trust": 1.7,
"url": "http://securitytracker.com/id?1016067"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/20069"
},
{
"trust": 1.7,
"url": "http://securityreason.com/securityalert/888"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/433828/100/0/threaded"
},
{
"trust": 1.1,
"url": "http://www.vupen.com/english/advisories/2006/1778"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26396"
},
{
"trust": 0.8,
"url": "http://www.apple.com/support/downloads/"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/433828/100/0/threaded"
},
{
"trust": 0.6,
"url": "http://www.frsirt.com/english/advisories/2006/1778"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/26396"
},
{
"trust": 0.4,
"url": "http://docs.info.apple.com/article.html?artnum=303752"
},
{
"trust": 0.3,
"url": "http://www.apple.com/quicktime/"
},
{
"trust": 0.3,
"url": "/archive/1/433850"
},
{
"trust": 0.3,
"url": "/archive/1/433810"
},
{
"trust": 0.3,
"url": "/archive/1/433828"
},
{
"trust": 0.1,
"url": "http://www.apple.com/quicktime/download/standalone.html\u003e"
},
{
"trust": 0.1,
"url": "http://www.kb.cert.org/vuls/byid?searchview\u0026query=quicktime_7.1\u003e"
},
{
"trust": 0.1,
"url": "http://docs.info.apple.com/article.html?artnum=303752\u003e"
},
{
"trust": 0.1,
"url": "http://www.us-cert.gov/cas/techalerts/ta06-132b.html\u003e"
},
{
"trust": 0.1,
"url": "http://www.us-cert.gov/legal.html\u003e"
},
{
"trust": 0.1,
"url": "http://docs.info.apple.com/article.html?artnum=106704\u003e"
},
{
"trust": 0.1,
"url": "http://www.us-cert.gov/cas/signup.html\u003e."
},
{
"trust": 0.1,
"url": "http://www.apple.com/support/downloads/quicktime71.html\u003e"
},
{
"trust": 0.1,
"url": "http://www.us-cert.gov/reading_room/securing_browser/\u003e"
},
{
"trust": 0.1,
"url": "http://docs.info.apple.com/article.html?artnum=61798"
},
{
"trust": 0.1,
"url": "http://www.tippingpoint.com"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2006-1463"
},
{
"trust": 0.1,
"url": "http://www.apple.com/support/downloads/quicktime71.html"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/5090/"
},
{
"trust": 0.1,
"url": "http://secway.org/advisory/ad20060512.txt"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/810/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/20069/"
},
{
"trust": 0.1,
"url": "http://www.eeye.com/html/research/advisories/ad20060511.html"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/7923/"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/215/"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-06-015"
},
{
"db": "VULHUB",
"id": "VHN-17571"
},
{
"db": "BID",
"id": "17953"
},
{
"db": "PACKETSTORM",
"id": "46427"
},
{
"db": "PACKETSTORM",
"id": "46409"
},
{
"db": "PACKETSTORM",
"id": "46260"
},
{
"db": "CNNVD",
"id": "CNNVD-200605-255"
},
{
"db": "NVD",
"id": "CVE-2006-1463"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-06-015"
},
{
"db": "VULHUB",
"id": "VHN-17571"
},
{
"db": "BID",
"id": "17953"
},
{
"db": "PACKETSTORM",
"id": "46427"
},
{
"db": "PACKETSTORM",
"id": "46409"
},
{
"db": "PACKETSTORM",
"id": "46260"
},
{
"db": "CNNVD",
"id": "CNNVD-200605-255"
},
{
"db": "NVD",
"id": "CVE-2006-1463"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2006-05-11T00:00:00",
"db": "ZDI",
"id": "ZDI-06-015"
},
{
"date": "2006-05-12T00:00:00",
"db": "VULHUB",
"id": "VHN-17571"
},
{
"date": "2006-05-11T00:00:00",
"db": "BID",
"id": "17953"
},
{
"date": "2006-05-22T00:50:08",
"db": "PACKETSTORM",
"id": "46427"
},
{
"date": "2006-05-21T19:15:50",
"db": "PACKETSTORM",
"id": "46409"
},
{
"date": "2006-05-17T05:39:52",
"db": "PACKETSTORM",
"id": "46260"
},
{
"date": "2005-11-07T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200605-255"
},
{
"date": "2006-05-12T20:06:00",
"db": "NVD",
"id": "CVE-2006-1463"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2006-05-11T00:00:00",
"db": "ZDI",
"id": "ZDI-06-015"
},
{
"date": "2018-10-18T00:00:00",
"db": "VULHUB",
"id": "VHN-17571"
},
{
"date": "2006-05-15T22:29:00",
"db": "BID",
"id": "17953"
},
{
"date": "2006-05-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200605-255"
},
{
"date": "2024-11-21T00:08:56.003000",
"db": "NVD",
"id": "CVE-2006-1463"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "46427"
},
{
"db": "CNNVD",
"id": "CNNVD-200605-255"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apple QuickTime H.264 Parsing Buffer Overflow Vulnerability",
"sources": [
{
"db": "ZDI",
"id": "ZDI-06-015"
}
],
"trust": 0.7
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200605-255"
}
],
"trust": 0.6
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.