Sign-up

ID

VAR-200511-0173


CVE

CVE-2005-2754


TITLE

Apple QuickTime PictureViewer PICT data decompression buffer overflow

Trust: 0.8

sources: CERT/CC: VU#855118

DESCRIPTION

Integer overflow in Apple QuickTime before 7.0.3 allows user-assisted attackers to execute arbitrary code via a crafted MOV file with "Improper movie attributes.". This issue is due to a failure of the application to properly validate integer signed-ness prior to using it to carry out critical operations. An attacker may leverage this issue to cause the affected QuickTime client to crash, denying service to legitimate users. It has been speculated that this issue may also facilitate code execution; any code execution would occur with the privileges of the user that activated the affected software. This issue affects both Microsoft Windows, and Apple versions of QuickTime. CVE-ID: CVE-2005-2754 Original location: http://pb.specialised.info/all/adv/quicktime-mov-io2-adv.txt Severity: Critical - remote code execution. Software affected: QuickTime package 7.0.1 for Mac OS X 10.3 QuickTime package 7.0.1 for Mac OS X 10.4 QuickTime package 6.5.2 for Mac OS X 10.3 QuickTime package 6.5.2 for Mac OS X 10.2 QuickTime package 7* for Windows Older versions may be also vulnerable. Note: Following versions are not vulnerable, due to the fact I have reported the vulnerabilities before their releases: QuickTime package 7.0.2 for Mac OS X 10.3 QuickTime package 7.0.2 for Mac OS X 10.4 0. DISCLAIMER Author takes no responsibility for any actions with provided informations or codes. The copyright for any material created by the author is reserved. Any duplication of codes or texts provided here in electronic or printed publications is not permitted without the author's agreement. I. BACKGROUND Apple QuickTime Player is one of the Apple QuickTime components used by hundreds of millions of users. II. Improper movie attributes could result in a very large memory copy, which lead to potencial memory overwrite. III. POC CODE Due to severity of this bug i will not release any proof of concept codes for this issue. IV. VENDOR RESPONSE Vendor (Apple) has been noticed and released all necessary patches. best regards, Piotr Bania -- -------------------------------------------------------------------- Piotr Bania - <bania.piotr@gmail.com> - 0xCD, 0x19 Fingerprint: 413E 51C7 912E 3D4E A62A BFA4 1FF6 689F BE43 AC33 http://pb.specialised.info - Key ID: 0xBE43AC33 -------------------------------------------------------------------- " Dinanzi a me non fuor cose create se non etterne, e io etterno duro. Lasciate ogne speranza, voi ch'intrate " - Dante, Inferno Canto III _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . TITLE: Apple QuickTime Multiple Vulnerabilities SECUNIA ADVISORY ID: SA17428 VERIFY ADVISORY: http://secunia.com/advisories/17428/ CRITICAL: Highly critical IMPACT: DoS, System access WHERE: >From remote SOFTWARE: Apple QuickTime 7.x http://secunia.com/product/5090/ Apple Quicktime 6.x http://secunia.com/product/810/ DESCRIPTION: Piotr Bania has reported some vulnerabilities in Apple QuickTime, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially to compromise a user's system. 1) An integer overflow error exists in the handling of a "Pascal" style string when loading a ".mov" video file. 3) A NULL pointer dereferencing error exists when handling certain missing movie attributes from a video file. 4) A boundary error exists in the QuickTime PictureViewer when decompressing PICT data. Prior versions may also be affected. SOLUTION: Update to version 7.0.3. http://www.apple.com/support/downloads/quicktime703.html PROVIDED AND/OR DISCOVERED BY: Piotr Bania ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=302772 Piotr Bania: http://pb.specialised.info/all/adv/quicktime-mov-io1-adv.txt http://pb.specialised.info/all/adv/quicktime-mov-io2-adv.txt http://pb.specialised.info/all/adv/quicktime-mov-dos-adv.txt http://pb.specialised.info/all/adv/quicktime-pict-adv.txt ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.16

sources: NVD: CVE-2005-2754 // CERT/CC: VU#855118 // BID: 15308 // VULHUB: VHN-13963 // PACKETSTORM: 41277 // PACKETSTORM: 41264

AFFECTED PRODUCTS

vendor:applemodel:quicktimescope:eqversion:6.5.2

Trust: 1.6

vendor:applemodel:quicktimescope:eqversion:7.0

Trust: 1.6

vendor:applemodel:quicktimescope:eqversion:7.0.1

Trust: 1.6

vendor:applemodel:quicktimescope:lteversion:7.0.2

Trust: 1.0

vendor:apple computermodel: - scope: - version: -

Trust: 0.8

vendor:applemodel:quicktimescope:eqversion:7.0.2

Trust: 0.6

vendor:applemodel:quicktime playerscope:eqversion:7.0.2

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.0.1

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.0

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:6.5.2

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:6.5.1

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:6.5

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:6.1

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:5.0.2

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:6

Trust: 0.3

vendor:applemodel:quicktime playerscope:neversion:7.0.3

Trust: 0.3

sources: CERT/CC: VU#855118 // BID: 15308 // CNNVD: CNNVD-200511-128 // NVD: CVE-2005-2754

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2005-2754
value: MEDIUM

Trust: 1.0

CARNEGIE MELLON: VU#855118
value: 8.61

Trust: 0.8

CNNVD: CNNVD-200511-128
value: MEDIUM

Trust: 0.6

VULHUB: VHN-13963
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2005-2754
severity: MEDIUM
baseScore: 5.1
vectorString: AV:N/AC:H/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 4.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

VULHUB: VHN-13963
severity: MEDIUM
baseScore: 5.1
vectorString: AV:N/AC:H/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 4.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CERT/CC: VU#855118 // VULHUB: VHN-13963 // CNNVD: CNNVD-200511-128 // NVD: CVE-2005-2754

PROBLEMTYPE DATA

problemtype:CWE-189

Trust: 1.1

sources: VULHUB: VHN-13963 // NVD: CVE-2005-2754

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 41277 // CNNVD: CNNVD-200511-128

TYPE

digital error

Trust: 0.6

sources: CNNVD: CNNVD-200511-128

EXPLOIT AVAILABILITY

sources:
            
            
            VULHUB: VHN-13963

EXTERNAL IDS
db:SECUNIAid:17428
Trust: 2.6
db:NVDid:CVE-2005-2754
Trust: 2.1
db:BIDid:15308
Trust: 2.0
db:VUPENid:ADV-2005-2293
Trust: 1.7
db:SECTRACKid:1015152
Trust: 1.7
db:OSVDBid:20476
Trust: 1.7
db:OSVDBid:20478
Trust: 0.8
db:CERT/CCid:VU#855118
Trust: 0.8
db:CNNVDid:CNNVD-200511-128
Trust: 0.7
db:BUGTRAQid:20051104 ADVISORY: APPLE QUICKTIME PLAYER REMOTE INTEGER OVERFLOW (2)
Trust: 0.6
db:PACKETSTORMid:41277
Trust: 0.2
db:VULHUBid:VHN-13963
Trust: 0.1
db:PACKETSTORMid:41264
Trust: 0.1
sources:
            
            
            CERT/CC: VU#855118 // 
            
            
            
            VULHUB: VHN-13963 // 
            
            
            
            BID: 15308 // 
            
            
            
            PACKETSTORM: 41277 // 
            
            
            
            PACKETSTORM: 41264 // 
            
            
            
            CNNVD: CNNVD-200511-128 // 
            
            
            
            NVD: CVE-2005-2754

REFERENCES
url:http://docs.info.apple.com/article.html?artnum=302772
Trust: 2.9
url:http://pb.specialised.info/all/adv/quicktime-mov-io2-adv.txt
Trust: 1.9
url:http://www.securityfocus.com/bid/15308
Trust: 1.7
url:http://www.osvdb.org/20476
Trust: 1.7
url:http://securitytracker.com/id?1015152
Trust: 1.7
url:http://secunia.com/advisories/17428
Trust: 1.7
url:http://www.securityfocus.com/archive/1/415709/30/0/threaded
Trust: 1.1
url:http://www.vupen.com/english/advisories/2005/2293
Trust: 1.1
url:http://secunia.com/advisories/17428/
Trust: 0.9
url:http://pb.specialised.info/all/adv/quicktime-pict-adv.txt
Trust: 0.9
url:http://www.osvdb.org/displayvuln.php?osvdb_id=20478
Trust: 0.8
url:http://www.securityfocus.com/archive/1/archive/1/415709/30/0/threaded
Trust: 0.6
url:http://www.frsirt.com/english/advisories/2005/2293
Trust: 0.6
url:http://www.apple.com/quicktime/
Trust: 0.3
url:http://www.info.apple.com/usen/security/security_updates.html
Trust: 0.3
url:/archive/1/415709
Trust: 0.3
url:http://pb.specialised.info
Trust: 0.1
url:http://secunia.com/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2005-2754
Trust: 0.1
url:http://lists.grok.org.uk/full-disclosure-charter.html
Trust: 0.1
url:http://www.apple.com/support/downloads/quicktime703.html
Trust: 0.1
url:http://secunia.com/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/product/5090/
Trust: 0.1
url:http://secunia.com/product/810/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://pb.specialised.info/all/adv/quicktime-mov-dos-adv.txt
Trust: 0.1
url:http://secunia.com/about_secunia_advisories/
Trust: 0.1
url:http://pb.specialised.info/all/adv/quicktime-mov-io1-adv.txt
Trust: 0.1
sources:
            
            
            CERT/CC: VU#855118 // 
            
            
            
            VULHUB: VHN-13963 // 
            
            
            
            BID: 15308 // 
            
            
            
            PACKETSTORM: 41277 // 
            
            
            
            PACKETSTORM: 41264 // 
            
            
            
            CNNVD: CNNVD-200511-128 // 
            
            
            
            NVD: CVE-2005-2754

CREDITS
Piotr Bania
Trust: 0.7
sources:
            
            
            PACKETSTORM: 41277 // 
            
            
            
            CNNVD: CNNVD-200511-128

SOURCES
db:CERT/CCid:VU#855118
db:VULHUBid:VHN-13963
db:BIDid:15308
db:PACKETSTORMid:41277
db:PACKETSTORMid:41264
db:CNNVDid:CNNVD-200511-128
db:NVDid:CVE-2005-2754

LAST UPDATE DATE
2024-08-14T14:00:33.088000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#855118date:2005-11-08T00:00:00
db:VULHUBid:VHN-13963date:2018-10-19T00:00:00
db:BIDid:15308date:2005-11-03T00:00:00
db:CNNVDid:CNNVD-200511-128date:2006-08-28T00:00:00
db:NVDid:CVE-2005-2754date:2018-10-19T15:33:35.870

SOURCES RELEASE DATE
db:CERT/CCid:VU#855118date:2005-11-08T00:00:00
db:VULHUBid:VHN-13963date:2005-11-05T00:00:00
db:BIDid:15308date:2005-11-03T00:00:00
db:PACKETSTORMid:41277date:2005-11-04T17:18:32
db:PACKETSTORMid:41264date:2005-11-04T17:09:11
db:CNNVDid:CNNVD-200511-128date:2005-11-05T00:00:00
db:NVDid:CVE-2005-2754date:2005-11-05T11:02:00