Vulnerabilities > CVE-2012-0670 - Numeric Errors vulnerability in Apple Quicktime
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
COMPLETE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
Integer overflow in Apple QuickTime before 7.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted sean atom in a movie file.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Nessus
NASL family Windows NASL id QUICKTIME_772.NASL description The version of QuickTime installed on the remote Windows host is older than 7.7.2 and may be affected by the following vulnerabilities : - An uninitialized memory access issue exists in the handling of MP4 encoded files. (CVE-2011-3458) - An off-by-one buffer overflow exists in the handling of rdrf atoms in QuickTime movie files. (CVE-2011-3459) - A stack-based buffer overflow exists in the QuickTime plugin last seen 2020-06-01 modified 2020-06-02 plugin id 59113 published 2012-05-16 reporter This script is Copyright (C) 2012-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/59113 title QuickTime < 7.7.2 Multiple Vulnerabilities (Windows) NASL family MacOS X Local Security Checks NASL id MACOSX_SECUPD2012-004.NASL description The remote host is running a version of Mac OS X 10.6 that does not have Security Update 2012-004 applied. This update contains multiple security-related fixes for the following components : - Apache - Data Security - DirectoryService - ImageIO - International Components for Unicode - Mail - PHP - QuickLook - QuickTime - Ruby last seen 2020-06-01 modified 2020-06-02 plugin id 62213 published 2012-09-20 reporter This script is Copyright (C) 2012-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/62213 title Mac OS X Multiple Vulnerabilities (Security Update 2012-004) (BEAST) NASL family MacOS X Local Security Checks NASL id MACOSX_10_7_5.NASL description The remote host is running a version of Mac OS X 10.7.x that is prior to 10.7.5. The newer version contains multiple security-related fixes for the following components : - Apache - BIND - CoreText - Data Security - ImageIO - Installer - International Components for Unicode - Kernel - Mail - PHP - Profile Manager - QuickLook - QuickTime - Ruby - USB last seen 2020-06-01 modified 2020-06-02 plugin id 62214 published 2012-09-20 reporter This script is Copyright (C) 2012-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/62214 title Mac OS X 10.7.x < 10.7.5 Multiple Vulnerabilities (BEAST)
Oval
| accepted | 2013-07-29T04:00:33.170-04:00 | ||||||||||||
| class | vulnerability | ||||||||||||
| contributors |
| ||||||||||||
| definition_extensions |
| ||||||||||||
| description | Integer overflow in Apple QuickTime before 7.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted sean atom in a movie file. | ||||||||||||
| family | windows | ||||||||||||
| id | oval:org.mitre.oval:def:16111 | ||||||||||||
| status | accepted | ||||||||||||
| submitted | 2012-12-11T16:37:33.623-05:00 | ||||||||||||
| title | Integer overflow in Apple QuickTime before 7.7.2 via a crafted sean atom in a movie file | ||||||||||||
| version | 7 |
Seebug
| bulletinFamily | exploit |
| description | BUGTRAQ ID: 53547 CVE ID: CVE-2012-0663,CVE-2012-0664,CVE-2012-0665,CVE-2012-0666,CVE-2012-0667,CVE-2012-0668,CVE-2012-0669,CVE-2012-0670,CVE-2012-0671,CVE-2012-0265 OS X Lion Server 内含一组应用软件，可将任意一台Mac 变成功能强大的服务器。Mac OS是一套运行于苹果的Macintosh系列电脑上的操作系统。 Windows 7、Vista、XP上的Apple QuickTime 7.7.2之前版本在处理特制文件的实现上存在多个安全漏洞，可允许远程攻击者以当前用户权限执行任意代码。 0 Apple QuickTime Player 7.x 厂商补丁： Apple ----- Apple已经为此发布了一个安全公告（APPLE-SA-2012-05-09-1）以及相应补丁: APPLE-SA-2012-05-09-1：OS X Lion v10.7.4 and Security Update 2012-002 |
| id | SSV:60131 |
| last seen | 2017-11-19 |
| modified | 2012-05-17 |
| published | 2012-05-17 |
| reporter | Root |
| title | Apple QuickTime 7.7.2之前版本多个远程任意代码执行漏洞 |
References
- http://lists.apple.com/archives/security-announce/2012/May/msg00005.html
- http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html
- http://support.apple.com/kb/HT5261
- http://support.apple.com/kb/HT5501
- http://www.securityfocus.com/bid/53582
- http://www.securitytracker.com/id?1027065
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16111