Signature Detail

HTTP: Apple QuickTime H.264 Movie File Buffer Overflow

This signature detects attempts to exploit a known vulnerability in the Mov file format. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the user.

Extended Description

Apple QuickTime is prone to multiple vulnerabilities that may allow remote attackers to execute arbitrary code. These issues arise when the application handles specially crafted H.264, MPEG-4, and FlashPix video files. Successful exploits may allow attackers to execute arbitrary code in the context of the currently logged-in user; failed exploit attempts will cause denial-of-service conditions. Versions prior to QuickTime 7.6.4 are vulnerable on Windows 7, Vista, XP, and Mac OS X platforms.

Affected Products

• Apple Mac OS X 10.6
• Apple Mac OS X 10.6.1
• Apple Mac OS X Server 10.6
• Apple Mac OS X Server 10.6.1
• Apple Quicktime 7.2
• Apple QuickTime Player 5.0.2
• Apple QuickTime Player 6
• Apple QuickTime Player 6.1.0
• Apple QuickTime Player 6.4
• Apple QuickTime Player 6.5.0
• Apple QuickTime Player 6.5.1
• Apple QuickTime Player 6.5.2
• Apple QuickTime Player 7.0.0
• Apple QuickTime Player 7.0.1
• Apple QuickTime Player 7.0.2
• Apple QuickTime Player 7.0.3
• Apple QuickTime Player 7.0.4
• Apple QuickTime Player 7.1
• Apple QuickTime Player 7.1.1
• Apple QuickTime Player 7.1.2
• Apple QuickTime Player 7.1.3
• Apple QuickTime Player 7.1.4
• Apple QuickTime Player 7.1.5
• Apple QuickTime Player 7.1.6
• Apple QuickTime Player 7.2
• Apple QuickTime Player 7.3
• Apple QuickTime Player 7.3.1
• Apple QuickTime Player 7.3.1.70
• Apple QuickTime Player 7.4
• Apple QuickTime Player 7.4.1
• Apple QuickTime Player 7.4.5
• Apple QuickTime Player 7.5
• Apple QuickTime Player 7.5.5
• Apple QuickTime Player 7.6
• Apple QuickTime Player 7.6.1
• Apple QuickTime Player 7.6.2

References

• BugTraq: 36328
• CVE: CVE-2009-2799