Sign-up

ID

VAR-200511-0174


CVE

CVE-2005-2755


TITLE

Apple QuickTime PictureViewer PICT data decompression buffer overflow

Trust: 0.8

sources: CERT/CC: VU#855118

DESCRIPTION

Apple QuickTime Player before 7.0.3 allows user-assisted attackers to cause a denial of service (crash) via a crafted file with a missing movie attribute, which leads to a null dereference. Apple QuickTime PictureViewer contains a buffer overflow that may allow a remote attacker to execute arbitrary code on a vulnerable system. QuickTime is prone to a denial of service vulnerability. This issue is due to a failure in the application to handle exceptional conditions. Successful exploitation of this vulnerability will cause the application to crash, effectively denying service to legitimate users. This issue affects both Microsoft Windows, and Apple versions of QuickTime. CVE-ID: CVE-2005-2755 Original location: http://pb.specialised.info/all/adv/quicktime-mov-dos-adv.txt Severity: Critical - attack against any application loading remotely-originated content. Software affected: QuickTime package 7.0.1 for Mac OS X 10.3 QuickTime package 7.0.1 for Mac OS X 10.4 QuickTime package 6.5.2 for Mac OS X 10.3 QuickTime package 6.5.2 for Mac OS X 10.2 QuickTime package 7* for Windows Older versions may be also vulnerable. Note: Following versions are not vulnerable, due to the fact I have reported the vulnerabilities before their releases: QuickTime package 7.0.2 for Mac OS X 10.3 QuickTime package 7.0.2 for Mac OS X 10.4 0. DISCLAIMER Author takes no responsibility for any actions with provided informations or codes. The copyright for any material created by the author is reserved. Any duplication of codes or texts provided here in electronic or printed publications is not permitted without the author's agreement. I. BACKGROUND Apple QuickTime Player is one of the Apple QuickTime components used by hundreds of millions of users. II. A missing movie attribute is interpreted as an extension, but the absence of the extension is not flagged as an error, resulting in a de-reference of a NULL pointer. III. POC CODE Due to severity of this bug i will not release any proof of concept codes for this issue. IV. VENDOR RESPONSE Vendor (Apple) has been noticed and released all necessary patches. best regards, Piotr Bania -- -------------------------------------------------------------------- Piotr Bania - <bania.piotr@gmail.com> - 0xCD, 0x19 Fingerprint: 413E 51C7 912E 3D4E A62A BFA4 1FF6 689F BE43 AC33 http://pb.specialised.info - Key ID: 0xBE43AC33 -------------------------------------------------------------------- " Dinanzi a me non fuor cose create se non etterne, e io etterno duro. Lasciate ogne speranza, voi ch'intrate " - Dante, Inferno Canto III _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . TITLE: Apple QuickTime Multiple Vulnerabilities SECUNIA ADVISORY ID: SA17428 VERIFY ADVISORY: http://secunia.com/advisories/17428/ CRITICAL: Highly critical IMPACT: DoS, System access WHERE: >From remote SOFTWARE: Apple QuickTime 7.x http://secunia.com/product/5090/ Apple Quicktime 6.x http://secunia.com/product/810/ DESCRIPTION: Piotr Bania has reported some vulnerabilities in Apple QuickTime, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially to compromise a user's system. 1) An integer overflow error exists in the handling of a "Pascal" style string when loading a ".mov" video file. This can result in memory overwrite due to a large memory copy, potentially allowing arbitrary code execution via a specially crafted video file. 2) An integer overflow error exists in the handling of certain movie attributes when loading a ".mov" video file. This can result in memory overwrite due to a large memory copy, potentially allowing arbitrary code execution via a specially crafted video file. This may be exploited to crash an application that uses QuickTime when a specially crafted video file is loaded. 4) A boundary error exists in the QuickTime PictureViewer when decompressing PICT data. This may be exploited to cause a memory overwrite, potentially allowing arbitrary code execution via a specially crafted PICT picture file. Prior versions may also be affected. SOLUTION: Update to version 7.0.3. http://www.apple.com/support/downloads/quicktime703.html PROVIDED AND/OR DISCOVERED BY: Piotr Bania ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=302772 Piotr Bania: http://pb.specialised.info/all/adv/quicktime-mov-io1-adv.txt http://pb.specialised.info/all/adv/quicktime-mov-io2-adv.txt http://pb.specialised.info/all/adv/quicktime-mov-dos-adv.txt http://pb.specialised.info/all/adv/quicktime-pict-adv.txt ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.25

sources: NVD: CVE-2005-2755 // CERT/CC: VU#855118 // BID: 15307 // VULHUB: VHN-13964 // VULMON: CVE-2005-2755 // PACKETSTORM: 41278 // PACKETSTORM: 41264

AFFECTED PRODUCTS

vendor:applemodel:quicktimescope:eqversion:6.5.2

Trust: 1.6

vendor:applemodel:quicktimescope:eqversion:7.0

Trust: 1.6

vendor:applemodel:quicktimescope:eqversion:7.0.1

Trust: 1.6

vendor:applemodel:quicktimescope:lteversion:7.0.2

Trust: 1.0

vendor:apple computermodel: - scope: - version: -

Trust: 0.8

vendor:applemodel:quicktimescope:eqversion:7.0.2

Trust: 0.6

vendor:applemodel:quicktime playerscope:eqversion:7.0.2

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.0.1

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.0

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:6.5.2

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:6.5.1

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:6.5

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:6.1

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:5.0.2

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:6

Trust: 0.3

vendor:applemodel:quicktime playerscope:neversion:7.0.3

Trust: 0.3

sources: CERT/CC: VU#855118 // BID: 15307 // CNNVD: CNNVD-200511-123 // NVD: CVE-2005-2755

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2005-2755
value: LOW

Trust: 1.0

CARNEGIE MELLON: VU#855118
value: 8.61

Trust: 0.8

CNNVD: CNNVD-200511-123
value: LOW

Trust: 0.6

VULHUB: VHN-13964
value: LOW

Trust: 0.1

VULMON: CVE-2005-2755
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2005-2755
severity: LOW
baseScore: 2.6
vectorString: AV:N/AC:H/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 4.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

VULHUB: VHN-13964
severity: LOW
baseScore: 2.6
vectorString: AV:N/AC:H/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 4.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CERT/CC: VU#855118 // VULHUB: VHN-13964 // VULMON: CVE-2005-2755 // CNNVD: CNNVD-200511-123 // NVD: CVE-2005-2755

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2005-2755

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 41278 // CNNVD: CNNVD-200511-123

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-200511-123

EXPLOIT AVAILABILITY

sources:
            
            
            VULHUB: VHN-13964

EXTERNAL IDS
db:SECUNIAid:17428
Trust: 2.7
db:NVDid:CVE-2005-2755
Trust: 2.2
db:BIDid:15307
Trust: 2.1
db:VUPENid:ADV-2005-2293
Trust: 1.8
db:SREASONid:145
Trust: 1.8
db:SECTRACKid:1015152
Trust: 1.8
db:OSVDBid:20477
Trust: 1.8
db:OSVDBid:20478
Trust: 0.8
db:CERT/CCid:VU#855118
Trust: 0.8
db:CNNVDid:CNNVD-200511-123
Trust: 0.7
db:BUGTRAQid:20051104 ADVISORY: APPLE QUICKTIME PLAYER REMOTE DENIAL OF SERVICE
Trust: 0.6
db:FULLDISCid:20051103 ADVISORY: APPLE QUICKTIME PLAYER REMOTE DENIAL OF SERVICE
Trust: 0.6
db:PACKETSTORMid:41278
Trust: 0.2
db:VULHUBid:VHN-13964
Trust: 0.1
db:VULMONid:CVE-2005-2755
Trust: 0.1
db:PACKETSTORMid:41264
Trust: 0.1
sources:
            
            
            CERT/CC: VU#855118 // 
            
            
            
            VULHUB: VHN-13964 // 
            
            
            
            VULMON: CVE-2005-2755 // 
            
            
            
            BID: 15307 // 
            
            
            
            PACKETSTORM: 41278 // 
            
            
            
            PACKETSTORM: 41264 // 
            
            
            
            CNNVD: CNNVD-200511-123 // 
            
            
            
            NVD: CVE-2005-2755

REFERENCES
url:http://docs.info.apple.com/article.html?artnum=302772
Trust: 3.0
url:http://pb.specialised.info/all/adv/quicktime-mov-dos-adv.txt
Trust: 2.0
url:http://www.securityfocus.com/bid/15307
Trust: 1.9
url:http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0102.html
Trust: 1.8
url:http://www.osvdb.org/20477
Trust: 1.8
url:http://securitytracker.com/id?1015152
Trust: 1.8
url:http://secunia.com/advisories/17428
Trust: 1.8
url:http://securityreason.com/securityalert/145
Trust: 1.8
url:http://www.securityfocus.com/archive/1/415717/30/0/threaded
Trust: 1.2
url:http://www.vupen.com/english/advisories/2005/2293
Trust: 1.2
url:http://secunia.com/advisories/17428/
Trust: 0.9
url:http://pb.specialised.info/all/adv/quicktime-pict-adv.txt
Trust: 0.9
url:http://www.osvdb.org/displayvuln.php?osvdb_id=20478
Trust: 0.8
url:http://www.securityfocus.com/archive/1/archive/1/415717/30/0/threaded
Trust: 0.6
url:http://www.frsirt.com/english/advisories/2005/2293
Trust: 0.6
url:http://www.apple.com/quicktime/
Trust: 0.3
url:http://www.info.apple.com/usen/security/security_updates.html
Trust: 0.3
url:/archive/1/415717
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2005-2755
Trust: 0.1
url:http://pb.specialised.info
Trust: 0.1
url:http://secunia.com/
Trust: 0.1
url:http://lists.grok.org.uk/full-disclosure-charter.html
Trust: 0.1
url:http://www.apple.com/support/downloads/quicktime703.html
Trust: 0.1
url:http://secunia.com/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/product/5090/
Trust: 0.1
url:http://secunia.com/product/810/
Trust: 0.1
url:http://pb.specialised.info/all/adv/quicktime-mov-io2-adv.txt
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/about_secunia_advisories/
Trust: 0.1
url:http://pb.specialised.info/all/adv/quicktime-mov-io1-adv.txt
Trust: 0.1
sources:
            
            
            CERT/CC: VU#855118 // 
            
            
            
            VULHUB: VHN-13964 // 
            
            
            
            VULMON: CVE-2005-2755 // 
            
            
            
            BID: 15307 // 
            
            
            
            PACKETSTORM: 41278 // 
            
            
            
            PACKETSTORM: 41264 // 
            
            
            
            CNNVD: CNNVD-200511-123 // 
            
            
            
            NVD: CVE-2005-2755

CREDITS
Piotr Bania  bania.piotr@gmail.com
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-200511-123

SOURCES
db:CERT/CCid:VU#855118
db:VULHUBid:VHN-13964
db:VULMONid:CVE-2005-2755
db:BIDid:15307
db:PACKETSTORMid:41278
db:PACKETSTORMid:41264
db:CNNVDid:CNNVD-200511-123
db:NVDid:CVE-2005-2755

LAST UPDATE DATE
2024-08-14T14:00:33.037000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#855118date:2005-11-08T00:00:00
db:VULHUBid:VHN-13964date:2018-10-19T00:00:00
db:VULMONid:CVE-2005-2755date:2018-10-19T00:00:00
db:BIDid:15307date:2005-11-03T00:00:00
db:CNNVDid:CNNVD-200511-123date:2006-08-28T00:00:00
db:NVDid:CVE-2005-2755date:2018-10-19T15:33:36.260

SOURCES RELEASE DATE
db:CERT/CCid:VU#855118date:2005-11-08T00:00:00
db:VULHUBid:VHN-13964date:2005-11-05T00:00:00
db:VULMONid:CVE-2005-2755date:2005-11-05T00:00:00
db:BIDid:15307date:2005-11-03T00:00:00
db:PACKETSTORMid:41278date:2005-11-04T17:20:19
db:PACKETSTORMid:41264date:2005-11-04T17:09:11
db:CNNVDid:CNNVD-200511-123date:2005-11-05T00:00:00
db:NVDid:CVE-2005-2755date:2005-11-05T11:02:00