Sign-up

ID

VAR-200511-0172


CVE

CVE-2005-2753


TITLE

Apple QuickTime Embedded Pascal Style Remote Integer Overflow Vulnerability

Trust: 0.9

sources: BID: 15306 // CNNVD: CNNVD-200511-126

DESCRIPTION

Integer overflow in Apple QuickTime before 7.0.3 allows user-assisted attackers to execute arbitrary code via a crafted MOV file that causes a sign extension of the length element in a Pascal style string. This issue is due to a failure of the application to properly validate integer signed-ness prior to using it to carry out critical operations. An attacker may leverage this issue to cause the affected QuickTime client to crash, denying service to legitimate users. It has been speculated that this issue may also facilitate code execution; any code execution would occur with the privileges of the user that activated the affected software. This issue affects both Microsoft Windows, and Apple versions of QuickTime. CVE-ID: CVE-2005-2753 Original location: http://pb.specialised.info/all/adv/quicktime-mov-io1-adv.txt Severity: Critical - remote code execution. Software affected: QuickTime package 7.0.1 for Mac OS X 10.3 QuickTime package 7.0.1 for Mac OS X 10.4 QuickTime package 6.5.2 for Mac OS X 10.3 QuickTime package 6.5.2 for Mac OS X 10.2 QuickTime package 7* for Windows Older versions may be also vulnerable. Note: Following versions are not vulnerable, due to the fact I have reported the vulnerabilities before their releases: QuickTime package 7.0.2 for Mac OS X 10.3 QuickTime package 7.0.2 for Mac OS X 10.4 0. DISCLAIMER Author takes no responsibility for any actions with provided informations or codes. The copyright for any material created by the author is reserved. Any duplication of codes or texts provided here in electronic or printed publications is not permitted without the author's agreement. I. BACKGROUND Apple QuickTime Player is one of the Apple QuickTime components used by hundreds of millions of users. II. A sign extension of an embedded "Pascal" style string could result in a very large memory copy, which lead to potencial memory overwrite. The vulnerability may lead to remote code execution when specially crafted video file (MOV file) is being loaded. III. POC CODE Due to severity of this bug i will not release any proof of concept codes for this issue. IV. VENDOR RESPONSE Vendor (Apple) has been noticed and released all necessary patches. best regards, Piotr Bania -- -------------------------------------------------------------------- Piotr Bania - <bania.piotr@gmail.com> - 0xCD, 0x19 Fingerprint: 413E 51C7 912E 3D4E A62A BFA4 1FF6 689F BE43 AC33 http://pb.specialised.info - Key ID: 0xBE43AC33 -------------------------------------------------------------------- " Dinanzi a me non fuor cose create se non etterne, e io etterno duro. Lasciate ogne speranza, voi ch'intrate " - Dante, Inferno Canto III _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . TITLE: Apple QuickTime Multiple Vulnerabilities SECUNIA ADVISORY ID: SA17428 VERIFY ADVISORY: http://secunia.com/advisories/17428/ CRITICAL: Highly critical IMPACT: DoS, System access WHERE: >From remote SOFTWARE: Apple QuickTime 7.x http://secunia.com/product/5090/ Apple Quicktime 6.x http://secunia.com/product/810/ DESCRIPTION: Piotr Bania has reported some vulnerabilities in Apple QuickTime, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially to compromise a user's system. 2) An integer overflow error exists in the handling of certain movie attributes when loading a ".mov" video file. 3) A NULL pointer dereferencing error exists when handling certain missing movie attributes from a video file. 4) A boundary error exists in the QuickTime PictureViewer when decompressing PICT data. Prior versions may also be affected. SOLUTION: Update to version 7.0.3. http://www.apple.com/support/downloads/quicktime703.html PROVIDED AND/OR DISCOVERED BY: Piotr Bania ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=302772 Piotr Bania: http://pb.specialised.info/all/adv/quicktime-mov-io1-adv.txt http://pb.specialised.info/all/adv/quicktime-mov-io2-adv.txt http://pb.specialised.info/all/adv/quicktime-mov-dos-adv.txt http://pb.specialised.info/all/adv/quicktime-pict-adv.txt ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.25

sources: NVD: CVE-2005-2753 // CERT/CC: VU#855118 // BID: 15306 // VULHUB: VHN-13962 // VULMON: CVE-2005-2753 // PACKETSTORM: 41276 // PACKETSTORM: 41264

AFFECTED PRODUCTS

vendor:applemodel:quicktimescope:eqversion:6.5.2

Trust: 1.6

vendor:applemodel:quicktimescope:eqversion:7.0

Trust: 1.6

vendor:applemodel:quicktimescope:eqversion:7.0.1

Trust: 1.6

vendor:applemodel:quicktimescope:lteversion:7.0.2

Trust: 1.0

vendor:apple computermodel: - scope: - version: -

Trust: 0.8

vendor:applemodel:quicktimescope:eqversion:7.0.2

Trust: 0.6

vendor:applemodel:quicktime playerscope:eqversion:7.0.2

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.0.1

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.0

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:6.5.2

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:6.5.1

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:6.5

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:6.1

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:5.0.2

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:6

Trust: 0.3

vendor:applemodel:quicktime playerscope:neversion:7.0.3

Trust: 0.3

sources: CERT/CC: VU#855118 // BID: 15306 // CNNVD: CNNVD-200511-126 // NVD: CVE-2005-2753

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2005-2753
value: MEDIUM

Trust: 1.0

CARNEGIE MELLON: VU#855118
value: 8.61

Trust: 0.8

CNNVD: CNNVD-200511-126
value: MEDIUM

Trust: 0.6

VULHUB: VHN-13962
value: MEDIUM

Trust: 0.1

VULMON: CVE-2005-2753
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2005-2753
severity: MEDIUM
baseScore: 5.1
vectorString: AV:N/AC:H/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 4.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

VULHUB: VHN-13962
severity: MEDIUM
baseScore: 5.1
vectorString: AV:N/AC:H/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 4.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CERT/CC: VU#855118 // VULHUB: VHN-13962 // VULMON: CVE-2005-2753 // CNNVD: CNNVD-200511-126 // NVD: CVE-2005-2753

PROBLEMTYPE DATA

problemtype:CWE-189

Trust: 1.1

sources: VULHUB: VHN-13962 // NVD: CVE-2005-2753

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 41276 // CNNVD: CNNVD-200511-126

TYPE

digital error

Trust: 0.6

sources: CNNVD: CNNVD-200511-126

EXPLOIT AVAILABILITY

sources:
            
            
            VULHUB: VHN-13962

EXTERNAL IDS
db:SECUNIAid:17428
Trust: 2.7
db:NVDid:CVE-2005-2753
Trust: 2.2
db:BIDid:15306
Trust: 2.1
db:OSVDBid:20475
Trust: 1.8
db:VUPENid:ADV-2005-2293
Trust: 1.7
db:SECTRACKid:1015152
Trust: 1.7
db:OSVDBid:20478
Trust: 0.8
db:CERT/CCid:VU#855118
Trust: 0.8
db:CNNVDid:CNNVD-200511-126
Trust: 0.7
db:BUGTRAQid:20051104 ADVISORY: APPLE QUICKTIME PLAYER REMOTE INTEGER OVERFLOW (1)
Trust: 0.6
db:PACKETSTORMid:41276
Trust: 0.2
db:VULHUBid:VHN-13962
Trust: 0.1
db:VUPENid:2005/2293
Trust: 0.1
db:VULMONid:CVE-2005-2753
Trust: 0.1
db:PACKETSTORMid:41264
Trust: 0.1
sources:
            
            
            CERT/CC: VU#855118 // 
            
            
            
            VULHUB: VHN-13962 // 
            
            
            
            VULMON: CVE-2005-2753 // 
            
            
            
            BID: 15306 // 
            
            
            
            PACKETSTORM: 41276 // 
            
            
            
            PACKETSTORM: 41264 // 
            
            
            
            CNNVD: CNNVD-200511-126 // 
            
            
            
            NVD: CVE-2005-2753

REFERENCES
url:http://docs.info.apple.com/article.html?artnum=302772
Trust: 3.0
url:http://pb.specialised.info/all/adv/quicktime-mov-io1-adv.txt
Trust: 2.0
url:http://www.securityfocus.com/bid/15306
Trust: 1.8
url:http://www.osvdb.org/20475
Trust: 1.8
url:http://securitytracker.com/id?1015152
Trust: 1.8
url:http://secunia.com/advisories/17428
Trust: 1.8
url:http://www.securityfocus.com/archive/1/415712/30/0/threaded
Trust: 1.2
url:http://www.vupen.com/english/advisories/2005/2293
Trust: 1.2
url:http://secunia.com/advisories/17428/
Trust: 0.9
url:http://pb.specialised.info/all/adv/quicktime-pict-adv.txt
Trust: 0.9
url:http://www.osvdb.org/displayvuln.php?osvdb_id=20478
Trust: 0.8
url:http://www.securityfocus.com/archive/1/archive/1/415712/30/0/threaded
Trust: 0.6
url:http://www.frsirt.com/english/advisories/2005/2293
Trust: 0.6
url:http://www.apple.com/quicktime/
Trust: 0.3
url:http://www.info.apple.com/usen/security/security_updates.html
Trust: 0.3
url:/archive/1/415712
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/189.html
Trust: 0.1
url:https://www.rapid7.com/db/vulnerabilities/windows-quicktime-mov-integer-overflow
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:http://pb.specialised.info
Trust: 0.1
url:http://secunia.com/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2005-2753
Trust: 0.1
url:http://lists.grok.org.uk/full-disclosure-charter.html
Trust: 0.1
url:http://www.apple.com/support/downloads/quicktime703.html
Trust: 0.1
url:http://secunia.com/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/product/5090/
Trust: 0.1
url:http://secunia.com/product/810/
Trust: 0.1
url:http://pb.specialised.info/all/adv/quicktime-mov-io2-adv.txt
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://pb.specialised.info/all/adv/quicktime-mov-dos-adv.txt
Trust: 0.1
url:http://secunia.com/about_secunia_advisories/
Trust: 0.1
sources:
            
            
            CERT/CC: VU#855118 // 
            
            
            
            VULHUB: VHN-13962 // 
            
            
            
            VULMON: CVE-2005-2753 // 
            
            
            
            BID: 15306 // 
            
            
            
            PACKETSTORM: 41276 // 
            
            
            
            PACKETSTORM: 41264 // 
            
            
            
            CNNVD: CNNVD-200511-126 // 
            
            
            
            NVD: CVE-2005-2753

CREDITS
Piotr Bania
Trust: 0.7
sources:
            
            
            PACKETSTORM: 41276 // 
            
            
            
            CNNVD: CNNVD-200511-126

SOURCES
db:CERT/CCid:VU#855118
db:VULHUBid:VHN-13962
db:VULMONid:CVE-2005-2753
db:BIDid:15306
db:PACKETSTORMid:41276
db:PACKETSTORMid:41264
db:CNNVDid:CNNVD-200511-126
db:NVDid:CVE-2005-2753

LAST UPDATE DATE
2024-08-14T14:00:32.992000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#855118date:2005-11-08T00:00:00
db:VULHUBid:VHN-13962date:2018-10-19T00:00:00
db:VULMONid:CVE-2005-2753date:2018-10-19T00:00:00
db:BIDid:15306date:2005-11-03T00:00:00
db:CNNVDid:CNNVD-200511-126date:2006-08-28T00:00:00
db:NVDid:CVE-2005-2753date:2018-10-19T15:33:34.633

SOURCES RELEASE DATE
db:CERT/CCid:VU#855118date:2005-11-08T00:00:00
db:VULHUBid:VHN-13962date:2005-11-05T00:00:00
db:VULMONid:CVE-2005-2753date:2005-11-05T00:00:00
db:BIDid:15306date:2005-11-03T00:00:00
db:PACKETSTORMid:41276date:2005-11-04T17:15:15
db:PACKETSTORMid:41264date:2005-11-04T17:09:11
db:CNNVDid:CNNVD-200511-126date:2005-11-05T00:00:00
db:NVDid:CVE-2005-2753date:2005-11-05T11:02:00