Sign-up

ID

VAR-200703-0011


CVE

CVE-2007-0713


TITLE

Apple QuickTime 3GP integer overflow

Trust: 0.8

sources: CERT/CC: VU#568689

DESCRIPTION

Heap-based buffer overflow in Apple QuickTime before 7.1.5 allows remote user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted QuickTime movie file. The Apple QuickTime player contains a heap buffer overflow vulnerability. This vulnerability may allow an attacker to execute arbitrary code or create a denial-of-service condition. Apple QuickTime is prone to multiple unspecified remote code-execution vulnerabilities including mulitple heap and stack-based buffer-overflow and integer-overflow issues. These issues arise when the application handles specially crafted 3GP, MIDI, MOV, PICT, and QTIF files. Successful attacks can result in the compromise of the applicaiton or can cause denial-of-service conditions. Few details regarding these issues are currently available. Separate BIDs for each issue will be created as new information becomes available. QuickTime versions prior to 7.1.5 are vulnerable. Apple QuickTime is a popular multimedia player that supports a wide variety of media formats. There are multiple buffer overflow vulnerabilities in QuickTime's processing of various media formats. Remote attackers may exploit these vulnerabilities to control the user's machine by enticing the user to open and process malformed media files. (CVE-2007-0713)

Trust: 8.01

sources: NVD: CVE-2007-0713 // CERT/CC: VU#568689 // CERT/CC: VU#880561 // CERT/CC: VU#822481 // CERT/CC: VU#861817 // CERT/CC: VU#448745 // CERT/CC: VU#313225 // CERT/CC: VU#410993 // CERT/CC: VU#642433 // JVNDB: JVNDB-2007-000193 // BID: 22827 // BID: 22843 // VULHUB: VHN-24075

AFFECTED PRODUCTS

vendor:apple computermodel: - scope: - version: -

Trust: 6.4

vendor:applemodel:quicktimescope:eqversion:7.1.1

Trust: 1.6

vendor:applemodel:quicktimescope:eqversion:7.0.4

Trust: 1.6

vendor:applemodel:quicktimescope:eqversion:7.1.2

Trust: 1.6

vendor:applemodel:quicktimescope:eqversion:7.1

Trust: 1.6

vendor:applemodel:quicktimescope:eqversion:7.1.4

Trust: 1.6

vendor:applemodel:quicktimescope:eqversion:7.0.1

Trust: 1.6

vendor:applemodel:quicktimescope:eqversion:7.0.2

Trust: 1.6

vendor:applemodel:quicktimescope:eqversion:7.0.3

Trust: 1.6

vendor:applemodel:quicktimescope:eqversion:7.1.3

Trust: 1.6

vendor:applemodel:quicktimescope:eqversion:7.0

Trust: 1.6

vendor:applemodel:quicktimescope:lteversion:7.1.4

Trust: 0.8

vendor:applemodel:quicktime playerscope:eqversion:7.1

Trust: 0.6

vendor:applemodel:quicktime playerscope:neversion:7.1.5

Trust: 0.6

vendor:applemodel:quicktime playerscope:eqversion:7.1.4

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.1.3

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.1.2

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.1.1

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.0.4

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.0.3

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.0.2

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.0.1

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:7.0

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:6.5.2

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:6.5.1

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:6.5

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:6.1

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:5.0.2

Trust: 0.3

vendor:applemodel:quicktime playerscope:eqversion:6

Trust: 0.3

sources: CERT/CC: VU#568689 // CERT/CC: VU#880561 // CERT/CC: VU#822481 // CERT/CC: VU#861817 // CERT/CC: VU#448745 // CERT/CC: VU#313225 // CERT/CC: VU#410993 // CERT/CC: VU#642433 // BID: 22827 // BID: 22843 // JVNDB: JVNDB-2007-000193 // CNNVD: CNNVD-200703-195 // NVD: CVE-2007-0713

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2007-0713
value: MEDIUM

Trust: 1.0

CARNEGIE MELLON: VU#568689
value: 16.20

Trust: 0.8

CARNEGIE MELLON: VU#880561
value: 6.64

Trust: 0.8

CARNEGIE MELLON: VU#822481
value: 9.00

Trust: 0.8

CARNEGIE MELLON: VU#861817
value: 17.36

Trust: 0.8

CARNEGIE MELLON: VU#448745
value: 4.81

Trust: 0.8

CARNEGIE MELLON: VU#313225
value: 17.72

Trust: 0.8

CARNEGIE MELLON: VU#410993
value: 16.20

Trust: 0.8

CARNEGIE MELLON: VU#642433
value: 16.20

Trust: 0.8

NVD: CVE-2007-0713
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-200703-195
value: MEDIUM

Trust: 0.6

VULHUB: VHN-24075
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2007-0713
severity: MEDIUM
baseScore: 5.8
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-24075
severity: MEDIUM
baseScore: 5.8
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CERT/CC: VU#568689 // CERT/CC: VU#880561 // CERT/CC: VU#822481 // CERT/CC: VU#861817 // CERT/CC: VU#448745 // CERT/CC: VU#313225 // CERT/CC: VU#410993 // CERT/CC: VU#642433 // VULHUB: VHN-24075 // JVNDB: JVNDB-2007-000193 // CNNVD: CNNVD-200703-195 // NVD: CVE-2007-0713

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2007-0713

THREAT TYPE

network

Trust: 0.6

sources: BID: 22827 // BID: 22843

TYPE

Boundary Condition Error

Trust: 0.6

sources: BID: 22827 // BID: 22843

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2007-000193

PATCH
title:QuickTime 7.1.5 for Macurl:http://www.apple.com/support/downloads/quicktime715formac.html
Trust: 0.8
title:QuickTime 7.1.5 for Windowsurl:http://www.apple.com/support/downloads/quicktime715forwindows.html
Trust: 0.8
title:QuickTime 7.1.5url:http://docs.info.apple.com/article.html?artnum=305149
Trust: 0.8
title:QuickTime 7.1.5url:http://docs.info.apple.com/article.html?artnum=305149-ja
Trust: 0.8
title:アップル - QuickTimeurl:http://www.apple.com/jp/quicktime/download/win.html
Trust: 0.8
title:QuickTime 7.1.5 for Windowsurl:http://www.apple.com/jp/ftp-info/reference/quicktime715forwindows.html
Trust: 0.8
title:QuickTime 7.1.5 for Macurl:http://www.apple.com/jp/ftp-info/reference/quicktime715formac.html
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2007-000193

EXTERNAL IDS
db:BIDid:22827
Trust: 9.2
db:SECUNIAid:24359
Trust: 8.9
db:SECTRACKid:1017725
Trust: 8.1
db:AUSCERTid:AL-2007.0031
Trust: 6.4
db:BIDid:22843
Trust: 3.6
db:CERT/CCid:VU#880561
Trust: 3.6
db:NVDid:CVE-2007-0713
Trust: 3.1
db:USCERTid:TA07-065A
Trust: 2.8
db:VUPENid:ADV-2007-0825
Trust: 1.7
db:XFid:32817
Trust: 1.4
db:CERT/CCid:VU#568689
Trust: 1.1
db:CERT/CCid:VU#822481
Trust: 1.1
db:CERT/CCid:VU#861817
Trust: 1.1
db:CERT/CCid:VU#448745
Trust: 1.1
db:CERT/CCid:VU#313225
Trust: 1.1
db:CERT/CCid:VU#410993
Trust: 1.1
db:CERT/CCid:VU#642433
Trust: 1.1
db:BIDid:22844
Trust: 0.8
db:ZDIid:ZDI-07-010
Trust: 0.8
db:USCERTid:SA07-065A
Trust: 0.8
db:JVNDBid:JVNDB-2007-000193
Trust: 0.8
db:CNNVDid:CNNVD-200703-195
Trust: 0.7
db:CERT/CCid:TA07-065A
Trust: 0.6
db:BUGTRAQid:20070306 APPLE QUICKTIME PLAYER REMOTE HEAP OVERFLOW
Trust: 0.6
db:APPLEid:APPLE-SA-2007-03-05
Trust: 0.6
db:VULHUBid:VHN-24075
Trust: 0.1
sources:
            
            
            CERT/CC: VU#568689 // 
            
            
            
            CERT/CC: VU#880561 // 
            
            
            
            CERT/CC: VU#822481 // 
            
            
            
            CERT/CC: VU#861817 // 
            
            
            
            CERT/CC: VU#448745 // 
            
            
            
            CERT/CC: VU#313225 // 
            
            
            
            CERT/CC: VU#410993 // 
            
            
            
            CERT/CC: VU#642433 // 
            
            
            
            VULHUB: VHN-24075 // 
            
            
            
            BID: 22827 // 
            
            
            
            BID: 22843 // 
            
            
            
            JVNDB: JVNDB-2007-000193 // 
            
            
            
            CNNVD: CNNVD-200703-195 // 
            
            
            
            NVD: CVE-2007-0713

REFERENCES
url:http://www.securityfocus.com/bid/22827
Trust: 8.9
url:http://docs.info.apple.com/article.html?artnum=305149
Trust: 8.4
url:http://secunia.com/advisories/24359/
Trust: 6.4
url:http://www.auscert.org.au/7356
Trust: 6.4
url:http://www.ciac.org/ciac/bulletins/r-171.shtml 
Trust: 6.4
url:http://securitytracker.com/id?1017725 
Trust: 5.6
url:http://www.securityfocus.com/bid/22843
Trust: 3.3
url:http://www.apple.com/quicktime/download/
Trust: 3.0
url:http://www.us-cert.gov/cas/techalerts/ta07-065a.html
Trust: 2.8
url:http://www.kb.cert.org/vuls/id/880561
Trust: 2.8
url:http://www.piotrbania.com/all/adv/quicktime-heap-adv-7.1.txt
Trust: 2.5
url:http://www.securitytracker.com/id?1017725
Trust: 2.5
url:http://secunia.com/advisories/24359
Trust: 2.5
url:http://www.us-cert.gov/cas/tips/st04-010.html
Trust: 2.4
url:http://support.microsoft.com/default.aspx?scid=kb;en-us;q294676
Trust: 2.4
url:http://www.cert.org/tech_tips/before_you_plug_in.html
Trust: 2.4
url:http://www.mozilla.org/support/firefox/faq
Trust: 2.4
url:http://lists.apple.com/archives/security-announce/2007/mar/msg00000.html
Trust: 1.7
url:http://www.apple.com/itunes/
Trust: 1.6
url:http://www.frsirt.com/english/advisories/2007/0825
Trust: 1.4
url:http://xforce.iss.net/xforce/xfdb/32817
Trust: 1.4
url:http://www.securityfocus.com/archive/1/461983/100/0/threaded
Trust: 1.1
url:http://www.vupen.com/english/advisories/2007/0825
Trust: 1.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/32817
Trust: 1.1
url:http://en.wikipedia.org/wiki/.mov
Trust: 0.8
url:http://en.wikipedia.org/wiki/musical_instrument_digital_interface
Trust: 0.8
url:http://developer.apple.com/documentation/quicktime/qtff/index.html
Trust: 0.8
url:http://developer.apple.com/documentation/quicktime/qtff/qtffchap2/chapter_3_section_2.html
Trust: 0.8
url:http://secway.org/advisory/ad20070306.txt
Trust: 0.8
url:http://secway.org/advisory/ad20060512.txt
Trust: 0.8
url:http://www.zerodayinitiative.com/advisories/zdi-07-010.html
Trust: 0.8
url:http://www.securityfocus.com/bid/22844
Trust: 0.8
url:http://en.wikipedia.org/wiki/pict
Trust: 0.8
url:http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=486
Trust: 0.8
url:http://www.reversemode.com/index.php?option=com_remository&itemid=2&func=fileinfo&id=46
Trust: 0.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-0713
Trust: 0.8
url:http://jvn.jp/cert/jvnta07-065a/index.html
Trust: 0.8
url:http://jvn.jp/tr/trta07-065a/index.html
Trust: 0.8
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2007-0713
Trust: 0.8
url:http://www.us-cert.gov/cas/alerts/sa07-065a.html
Trust: 0.8
url:http://www.cyberpolice.go.jp/important/2007/20070306_153534.html
Trust: 0.8
url:http://www.apple.com/quicktime/
Trust: 0.6
url:http://www.securityfocus.com/archive/1/archive/1/461983/100/0/threaded
Trust: 0.6
url:msg://bugtraq/45ec9719.10206@idefense.com
Trust: 0.3
url:http://www.kb.cert.org/vuls/id/313225
Trust: 0.3
url:http://www.kb.cert.org/vuls/id/410993
Trust: 0.3
url:http://www.kb.cert.org/vuls/id/448745
Trust: 0.3
url:http://www.kb.cert.org/vuls/id/568689
Trust: 0.3
url:http://www.kb.cert.org/vuls/id/642433
Trust: 0.3
url:http://www.kb.cert.org/vuls/id/822481
Trust: 0.3
url:http://www.kb.cert.org/vuls/id/861817
Trust: 0.3
url:/archive/1/461983
Trust: 0.3
sources:
            
            
            CERT/CC: VU#568689 // 
            
            
            
            CERT/CC: VU#880561 // 
            
            
            
            CERT/CC: VU#822481 // 
            
            
            
            CERT/CC: VU#861817 // 
            
            
            
            CERT/CC: VU#448745 // 
            
            
            
            CERT/CC: VU#313225 // 
            
            
            
            CERT/CC: VU#410993 // 
            
            
            
            CERT/CC: VU#642433 // 
            
            
            
            VULHUB: VHN-24075 // 
            
            
            
            BID: 22827 // 
            
            
            
            BID: 22843 // 
            
            
            
            JVNDB: JVNDB-2007-000193 // 
            
            
            
            CNNVD: CNNVD-200703-195 // 
            
            
            
            NVD: CVE-2007-0713

CREDITS
JJ Reyes
Mike Price
iotr Bania
Artur Ogloza
Piotr Bania※ bania.piotr@gmail.com※Sowhat※ smaillist@gmail.com※http://www.zerodayinitiative.com/
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-200703-195

SOURCES
db:CERT/CCid:VU#568689
db:CERT/CCid:VU#880561
db:CERT/CCid:VU#822481
db:CERT/CCid:VU#861817
db:CERT/CCid:VU#448745
db:CERT/CCid:VU#313225
db:CERT/CCid:VU#410993
db:CERT/CCid:VU#642433
db:VULHUBid:VHN-24075
db:BIDid:22827
db:BIDid:22843
db:JVNDBid:JVNDB-2007-000193
db:CNNVDid:CNNVD-200703-195
db:NVDid:CVE-2007-0713

LAST UPDATE DATE
2024-11-23T21:10:28.999000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#568689date:2007-03-19T00:00:00
db:CERT/CCid:VU#880561date:2007-03-19T00:00:00
db:CERT/CCid:VU#822481date:2007-03-19T00:00:00
db:CERT/CCid:VU#861817date:2007-03-19T00:00:00
db:CERT/CCid:VU#448745date:2007-03-09T00:00:00
db:CERT/CCid:VU#313225date:2007-03-19T00:00:00
db:CERT/CCid:VU#410993date:2007-03-19T00:00:00
db:CERT/CCid:VU#642433date:2007-03-19T00:00:00
db:VULHUBid:VHN-24075date:2018-10-16T00:00:00
db:BIDid:22827date:2007-03-06T21:05:00
db:BIDid:22843date:2007-03-06T20:35:00
db:JVNDBid:JVNDB-2007-000193date:2007-04-19T00:00:00
db:CNNVDid:CNNVD-200703-195date:2007-03-07T00:00:00
db:NVDid:CVE-2007-0713date:2024-11-21T00:26:33.633

SOURCES RELEASE DATE
db:CERT/CCid:VU#568689date:2007-03-06T00:00:00
db:CERT/CCid:VU#880561date:2007-03-06T00:00:00
db:CERT/CCid:VU#822481date:2007-03-06T00:00:00
db:CERT/CCid:VU#861817date:2007-03-06T00:00:00
db:CERT/CCid:VU#448745date:2007-03-06T00:00:00
db:CERT/CCid:VU#313225date:2007-03-06T00:00:00
db:CERT/CCid:VU#410993date:2007-03-06T00:00:00
db:CERT/CCid:VU#642433date:2007-03-06T00:00:00
db:VULHUBid:VHN-24075date:2007-03-05T00:00:00
db:BIDid:22827date:2007-03-05T00:00:00
db:BIDid:22843date:2007-03-06T00:00:00
db:JVNDBid:JVNDB-2007-000193date:2007-04-19T00:00:00
db:CNNVDid:CNNVD-200703-195date:2007-03-05T00:00:00
db:NVDid:CVE-2007-0713date:2007-03-05T22:19:00