Signature Detail

HTTP: Apple QuickTime Panorama Sample Atoms Movie File Handling Buffer Overflow

This signature detects attempts to exploit a known buffer overflow vulnerability in Apple QuickTime. It is due to boundary errors in the QuickTime Virtual Reality (QTVR) when processing QTVR movie files. A remote attacker can exploit this by enticing the target user to open a crafted QTVR movie file. A successful attack can lead to arbitrary code execution in the security context of the logged in user. The behavior of the target is entirely dependent on the intended function of the injected code. In an unsuccessful attack, the affected Apple QuickTime process terminates abnormally.

Extended Description

Apple QuickTime is prone to a heap-based buffer-overflow issue because it fails to perform adequate boundary checks on user-supplied data. An attacker can exploit this issue by enticing an unsuspecting user to open a specially crafted movie file. Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the user running the application. Failed exploit attempts likely result in denial-of-service conditions. This issue affects Apple QuickTime running on Microsoft Windows Vista, Microsoft Windows XP SP2, and Mac OS X.

Affected Products

• Apple QuickTime Player 7.0.0
• Apple QuickTime Player 7.0.1
• Apple QuickTime Player 7.0.2
• Apple QuickTime Player 7.0.3
• Apple QuickTime Player 7.0.4
• Apple QuickTime Player 7.1
• Apple QuickTime Player 7.1.1
• Apple QuickTime Player 7.1.2
• Apple QuickTime Player 7.1.3
• Apple QuickTime Player 7.1.4
• Apple QuickTime Player 7.1.5
• Apple QuickTime Player 7.1.6
• Apple QuickTime Player 7.2

References

• BugTraq: 26342
• CVE: CVE-2007-4675