Signature Detail
Short Name |
HTTP:STC:DL:APPLE-QT-JPEG-2000 |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
Apple QuickTime JPEG 2000 COD Length Integer Underflow |
Release Date |
2012/01/30 |
Update Number |
2072 |
Supported Platforms |
idp-4.0+, isg-3.1.134269+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: Apple QuickTime JPEG 2000 COD Length Integer Underflow
This signature detects attempts to exploit a known vulnerability in the Apple's QuickTime media player. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the affected application.
Extended Description
Apple QuickTime is prone to an integer-overflow vulnerability due to a failure to properly bounds-check user-supplied data. The problem occurs when handling a specially crafted movie file. Successful exploits may allow attackers to execute arbitrary code in the context of the currently logged-in user; failed exploit attempts may cause denial-of-service conditions. Versions prior to QuickTime 7.7.1 are vulnerable on Windows 7, Vista, and XP. NOTE: This issue was previously discussed in BID 50388 (Apple QuickTime Prior To 7.7.1 Multiple Arbitrary Code Execution Vulnerabilities) but has been given its own record to better document it.
Affected Products
- Apple Mac Os X 10.6.5
- Apple Mac Os X 10.6.6
- Apple Mac Os X 10.6.7
- Apple Mac Os X 10.6.8
- Apple Mac Os X 10.7
- Apple Mac Os X 10.7.1
- Apple Mac Os X 10.7.2
- Apple Mac OS X 10.6
- Apple Mac OS X 10.6.1
- Apple Mac OS X 10.6.2
- Apple Mac OS X 10.6.3
- Apple Mac OS X 10.6.4
- Apple Mac OS X 10.6.5
- Apple Mac Os X Server 10.6.7
- Apple Mac Os X Server 10.6.8
- Apple Mac Os X Server 10.7
- Apple Mac Os X Server 10.7.1
- Apple Mac Os X Server 10.7.2
- Apple Mac OS X Server 10.6
- Apple Mac OS X Server 10.6.1
- Apple Mac OS X Server 10.6.2
- Apple Mac OS X Server 10.6.3
- Apple Mac OS X Server 10.6.4
- Apple Mac OS X Server 10.6.5
- Apple Mac OS X Server 10.6.5
- Apple Mac OS X Server 10.6.6
- Apple QuickTime Player 7.4
- Apple QuickTime Player 7.4.1
- Apple QuickTime Player 7.4.5
- Apple QuickTime Player 7.5
- Apple QuickTime Player 7.5.5
- Apple QuickTime Player 7.6
- Apple QuickTime Player 7.6.1
- Apple QuickTime Player 7.6.2
- Apple QuickTime Player 7.6.4
- Apple QuickTime Player 7.64.17.73
- Apple QuickTime Player 7.6.5
- Apple QuickTime Player 7.6.6
- Apple QuickTime Player 7.6.6 (1671)
- Apple QuickTime Player 7.6.7
- Apple QuickTime Player 7.6.8
- Apple QuickTime Player 7.6.9
- Apple QuickTime Player 7.7
References
- BugTraq: 50401
- CVE: CVE-2011-3250
- URL: http://support.apple.com/kb/HT5016