Signature Detail

HTTP: QuickTime FlashPix File Buffer Overflow

This signature detects attempts to exploit a known vulnerability in Apple QuickTime. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the client.

Extended Description

Apple QuickTime is prone to multiple vulnerabilities that may allow remote attackers to execute arbitrary code. These issues arise when the application handles specially crafted H.264, MPEG-4, and FlashPix video files. Successful exploits may allow attackers to execute arbitrary code in the context of the currently logged-in user; failed exploit attempts will cause denial-of-service conditions. Versions prior to QuickTime 7.6.4 are vulnerable on Windows 7, Vista, XP, and Mac OS X platforms.

Affected Products

• Apple Mac OS X 10.6
• Apple Mac OS X 10.6.1
• Apple Mac OS X Server 10.6
• Apple Mac OS X Server 10.6.1
• Apple Quicktime 7.2
• Apple QuickTime Player 5.0.2
• Apple QuickTime Player 6
• Apple QuickTime Player 6.1.0
• Apple QuickTime Player 6.4
• Apple QuickTime Player 6.5.0
• Apple QuickTime Player 6.5.1
• Apple QuickTime Player 6.5.2
• Apple QuickTime Player 7.0.0
• Apple QuickTime Player 7.0.1
• Apple QuickTime Player 7.0.2
• Apple QuickTime Player 7.0.3
• Apple QuickTime Player 7.0.4
• Apple QuickTime Player 7.1
• Apple QuickTime Player 7.1.1
• Apple QuickTime Player 7.1.2
• Apple QuickTime Player 7.1.3
• Apple QuickTime Player 7.1.4
• Apple QuickTime Player 7.1.5
• Apple QuickTime Player 7.1.6
• Apple QuickTime Player 7.2
• Apple QuickTime Player 7.3
• Apple QuickTime Player 7.3.1
• Apple QuickTime Player 7.3.1.70
• Apple QuickTime Player 7.4
• Apple QuickTime Player 7.4.1
• Apple QuickTime Player 7.4.5
• Apple QuickTime Player 7.5
• Apple QuickTime Player 7.5.5
• Apple QuickTime Player 7.6
• Apple QuickTime Player 7.6.1
• Apple QuickTime Player 7.6.2

References

• BugTraq: 36328
• CVE: CVE-2009-2798
• URL: http://support.apple.com/kb/HT3859