Sign-up

ID

VAR-200511-0175


CVE

CVE-2005-2756


TITLE

Apple QuickTime PictureViewer PICT data decompression buffer overflow

Trust: 0.8

sources: CERT/CC: VU#855118

DESCRIPTION

Apple QuickTime before 7.0.3 allows user-assisted attackers to overwrite memory and execute arbitrary code via a crafted PICT file that triggers an overflow during expansion. This issue is due to a failure of the application to properly bounds check user-supplied data prior to copying it to an insufficiently sized memory buffer. An attacker may leverage this issue to cause the affected QuickTime client to crash, denying service to legitimate users. It has been speculated that this issue may also facilitate code execution; any code execution would occur with the privileges of the user that activated the affected software. This issue affects both Microsoft Windows, and Apple versions of QuickTime. CVE-ID: CVE-2005-2756 Original location: http://pb.specialised.info/all/adv/quicktime-pict-adv.txt Severity: Critical - remote code execution. Software affected: QuickTime package 7.0.1 for Mac OS X 10.3 QuickTime package 7.0.1 for Mac OS X 10.4 QuickTime package 6.5.2 for Mac OS X 10.3 QuickTime package 6.5.2 for Mac OS X 10.2 QuickTime package 7* for Windows Older versions may be also vulnerable. Note: Following versions are not vulnerable, due to the fact I have reported the vulnerabilities before their releases: QuickTime package 7.0.2 for Mac OS X 10.3 QuickTime package 7.0.2 for Mac OS X 10.4 0. DISCLAIMER Author takes no responsibility for any actions with provided informations or codes. The copyright for any material created by the author is reserved. Any duplication of codes or texts provided here in electronic or printed publications is not permitted without the author's agreement. I. BACKGROUND Apple QuickTime PictureViewer is one of the Apple QuickTime components used by hundreds of millions of users. II. Expansion of compressed PICT data could exceed the size of the destination buffer, this cause an memory overwrite. The vulnerability may lead to remote code execution when specially crafted picture file (PICT file) is being loaded. III. POC CODE Due to severity of this bug i will not release any proof of concept codes for this issue. IV. VENDOR RESPONSE Vendor (Apple) has been noticed and released all necessary patches. best regards, Piotr Bania -- -------------------------------------------------------------------- Piotr Bania - <bania.piotr@gmail.com> - 0xCD, 0x19 Fingerprint: 413E 51C7 912E 3D4E A62A BFA4 1FF6 689F BE43 AC33 http://pb.specialised.info - Key ID: 0xBE43AC33 -------------------------------------------------------------------- " Dinanzi a me non fuor cose create se non etterne, e io etterno duro. Lasciate ogne speranza, voi ch'intrate " - Dante, Inferno Canto III _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . TITLE: Apple QuickTime Multiple Vulnerabilities SECUNIA ADVISORY ID: SA17428 VERIFY ADVISORY: http://secunia.com/advisories/17428/ CRITICAL: Highly critical IMPACT: DoS, System access WHERE: >From remote SOFTWARE: Apple QuickTime 7.x http://secunia.com/product/5090/ Apple Quicktime 6.x http://secunia.com/product/810/ DESCRIPTION: Piotr Bania has reported some vulnerabilities in Apple QuickTime, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially to compromise a user's system. 1) An integer overflow error exists in the handling of a "Pascal" style string when loading a ".mov" video file. 2) An integer overflow error exists in the handling of certain movie attributes when loading a ".mov" video file. 3) A NULL pointer dereferencing error exists when handling certain missing movie attributes from a video file. 4) A boundary error exists in the QuickTime PictureViewer when decompressing PICT data. Prior versions may also be affected. SOLUTION: Update to version 7.0.3. http://www.apple.com/support/downloads/quicktime703.html PROVIDED AND/OR DISCOVERED BY: Piotr Bania ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=302772 Piotr Bania: http://pb.specialised.info/all/adv/quicktime-mov-io1-adv.txt http://pb.specialised.info/all/adv/quicktime-mov-io2-adv.txt http://pb.specialised.info/all/adv/quicktime-mov-dos-adv.txt http://pb.specialised.info/all/adv/quicktime-pict-adv.txt ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.16

sources: NVD: CVE-2005-2756 // CERT/CC: VU#855118 // BID: 15309 // VULHUB: VHN-13965 // PACKETSTORM: 41279 // PACKETSTORM: 41264

AFFECTED PRODUCTS

vendor:applemodel:quicktimescope:eqversion:6.5.2

Trust: 1.6

vendor:applemodel:quicktimescope:eqversion:7.0

Trust: 1.6

vendor:applemodel:quicktimescope:eqversion:7.0.1

Trust: 1.6

vendor:applemodel:quicktimescope:lteversion:7.0.2

Trust: 1.0

vendor:apple computermodel: - scope: - version: -

Trust: 0.8

vendor:applemodel:quicktimescope:eqversion:7.0.2

Trust: 0.6

vendor:applemodel:quicktime playerscope:eqversion:7.0.2

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.0.1

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.0

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:6.5.2

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:6.5.1

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:6.5

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:6.1

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:5.0.2

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:6

Trust: 0.3

vendor:applemodel:quicktime playerscope:neversion:7.0.3

Trust: 0.3

sources: CERT/CC: VU#855118 // BID: 15309 // CNNVD: CNNVD-200511-132 // NVD: CVE-2005-2756

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2005-2756
value: MEDIUM

Trust: 1.0

CARNEGIE MELLON: VU#855118
value: 8.61

Trust: 0.8

CNNVD: CNNVD-200511-132
value: MEDIUM

Trust: 0.6

VULHUB: VHN-13965
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2005-2756
severity: MEDIUM
baseScore: 5.1
vectorString: AV:N/AC:H/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 4.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

VULHUB: VHN-13965
severity: MEDIUM
baseScore: 5.1
vectorString: AV:N/AC:H/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 4.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CERT/CC: VU#855118 // VULHUB: VHN-13965 // CNNVD: CNNVD-200511-132 // NVD: CVE-2005-2756

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2005-2756

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 41279 // CNNVD: CNNVD-200511-132

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-200511-132

EXPLOIT AVAILABILITY

sources:
            
            
            VULHUB: VHN-13965

EXTERNAL IDS
db:SECUNIAid:17428
Trust: 2.6
db:OSVDBid:20478
Trust: 2.5
db:CERT/CCid:VU#855118
Trust: 2.5
db:NVDid:CVE-2005-2756
Trust: 2.1
db:BIDid:15309
Trust: 2.0
db:SREASONid:144
Trust: 1.7
db:VUPENid:ADV-2005-2293
Trust: 1.7
db:SECTRACKid:1015152
Trust: 1.7
db:CNNVDid:CNNVD-200511-132
Trust: 0.7
db:BUGTRAQid:20051104 ADVISORY: APPLE QUICKTIME PICT REMOTE MEMORY OVERWRITE
Trust: 0.6
db:PACKETSTORMid:41279
Trust: 0.2
db:VULHUBid:VHN-13965
Trust: 0.1
db:PACKETSTORMid:41264
Trust: 0.1
sources:
            
            
            CERT/CC: VU#855118 // 
            
            
            
            VULHUB: VHN-13965 // 
            
            
            
            BID: 15309 // 
            
            
            
            PACKETSTORM: 41279 // 
            
            
            
            PACKETSTORM: 41264 // 
            
            
            
            CNNVD: CNNVD-200511-132 // 
            
            
            
            NVD: CVE-2005-2756

REFERENCES
url:http://docs.info.apple.com/article.html?artnum=302772
Trust: 2.9
url:http://pb.specialised.info/all/adv/quicktime-pict-adv.txt
Trust: 2.7
url:http://www.securityfocus.com/bid/15309
Trust: 1.7
url:http://www.kb.cert.org/vuls/id/855118
Trust: 1.7
url:http://www.osvdb.org/20478
Trust: 1.7
url:http://securitytracker.com/id?1015152
Trust: 1.7
url:http://secunia.com/advisories/17428
Trust: 1.7
url:http://securityreason.com/securityalert/144
Trust: 1.7
url:http://www.securityfocus.com/archive/1/415714/30/0/threaded
Trust: 1.1
url:http://www.vupen.com/english/advisories/2005/2293
Trust: 1.1
url:http://secunia.com/advisories/17428/
Trust: 0.9
url:http://www.osvdb.org/displayvuln.php?osvdb_id=20478
Trust: 0.8
url:http://www.securityfocus.com/archive/1/archive/1/415714/30/0/threaded
Trust: 0.6
url:http://www.frsirt.com/english/advisories/2005/2293
Trust: 0.6
url:http://www.apple.com/quicktime/
Trust: 0.3
url:http://www.info.apple.com/usen/security/security_updates.html
Trust: 0.3
url:/archive/1/415714
Trust: 0.3
url:http://pb.specialised.info
Trust: 0.1
url:http://secunia.com/
Trust: 0.1
url:http://lists.grok.org.uk/full-disclosure-charter.html
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2005-2756
Trust: 0.1
url:http://www.apple.com/support/downloads/quicktime703.html
Trust: 0.1
url:http://secunia.com/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/product/5090/
Trust: 0.1
url:http://secunia.com/product/810/
Trust: 0.1
url:http://pb.specialised.info/all/adv/quicktime-mov-io2-adv.txt
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://pb.specialised.info/all/adv/quicktime-mov-dos-adv.txt
Trust: 0.1
url:http://secunia.com/about_secunia_advisories/
Trust: 0.1
url:http://pb.specialised.info/all/adv/quicktime-mov-io1-adv.txt
Trust: 0.1
sources:
            
            
            CERT/CC: VU#855118 // 
            
            
            
            VULHUB: VHN-13965 // 
            
            
            
            BID: 15309 // 
            
            
            
            PACKETSTORM: 41279 // 
            
            
            
            PACKETSTORM: 41264 // 
            
            
            
            CNNVD: CNNVD-200511-132 // 
            
            
            
            NVD: CVE-2005-2756

CREDITS
Piotr Bania  bania.piotr@gmail.com
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-200511-132

SOURCES
db:CERT/CCid:VU#855118
db:VULHUBid:VHN-13965
db:BIDid:15309
db:PACKETSTORMid:41279
db:PACKETSTORMid:41264
db:CNNVDid:CNNVD-200511-132
db:NVDid:CVE-2005-2756

LAST UPDATE DATE
2024-08-14T14:00:33.132000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#855118date:2005-11-08T00:00:00
db:VULHUBid:VHN-13965date:2018-10-19T00:00:00
db:BIDid:15309date:2005-11-03T00:00:00
db:CNNVDid:CNNVD-200511-132date:2006-08-28T00:00:00
db:NVDid:CVE-2005-2756date:2018-10-19T15:33:36.807

SOURCES RELEASE DATE
db:CERT/CCid:VU#855118date:2005-11-08T00:00:00
db:VULHUBid:VHN-13965date:2005-11-05T00:00:00
db:BIDid:15309date:2005-11-03T00:00:00
db:PACKETSTORMid:41279date:2005-11-04T17:22:06
db:PACKETSTORMid:41264date:2005-11-04T17:09:11
db:CNNVDid:CNNVD-200511-132date:2005-11-05T00:00:00
db:NVDid:CVE-2005-2756date:2005-11-05T11:02:00