Signature Detail
Short Name |
HTTP:STC:DL:QUICKTIME-PAINTPOLY |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
Apple QuickTime PICT Image paintPoly Parsing Heap Buffer Overflow |
Release Date |
2013/04/04 |
Update Number |
2252 |
Supported Platforms |
idp-4.0+, isg-3.1.134269+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: Apple QuickTime PICT Image paintPoly Parsing Heap Buffer Overflow
This signature detects attempts to exploit a known vulnerability in the Apple QuickTime PICT Image paintPoly Parsing. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the application.
Extended Description
Apple Mac OS X is prone to an integer-overflow vulnerability when handling PICT image files. An attacker can exploit this issue to execute arbitrary code in the context of the victim. NOTE: This issue was previously covered in BID 34926 (Apple Mac OS X 2009-002 Multiple Security Vulnerabilities), but has been assigned its own record to better document it.
Affected Products
- Apple Mac OS X 10.4.0
- Apple Mac OS X 10.4.1
- Apple Mac OS X 10.4.10
- Apple Mac OS X 10.4.11
- Apple Mac OS X 10.4.2
- Apple Mac OS X 10.4.3
- Apple Mac OS X 10.4.4
- Apple Mac OS X 10.4.5
- Apple Mac OS X 10.4.6
- Apple Mac OS X 10.4.7
- Apple Mac OS X 10.4.8
- Apple Mac OS X 10.4.9
- Apple Mac OS X 10.5
- Apple Mac OS X 10.5.1
- Apple Mac OS X 10.5.2
- Apple Mac OS X 10.5.3
- Apple Mac OS X 10.5.4
- Apple Mac OS X 10.5.5
- Apple Mac OS X 10.5.6
- Apple Mac OS X Server 10.4.0
- Apple Mac OS X Server 10.4.1
- Apple Mac OS X Server 10.4.10
- Apple Mac OS X Server 10.4.11
- Apple Mac OS X Server 10.4.2
- Apple Mac OS X Server 10.4.3
- Apple Mac OS X Server 10.4.4
- Apple Mac OS X Server 10.4.5
- Apple Mac OS X Server 10.4.6
- Apple Mac OS X Server 10.4.7
- Apple Mac OS X Server 10.4.8
- Apple Mac OS X Server 10.4.9
- Apple Mac OS X Server 10.5
- Apple Mac OS X Server 10.5.1
- Apple Mac OS X Server 10.5.2
- Apple Mac OS X Server 10.5.3
- Apple Mac OS X Server 10.5.4
- Apple Mac OS X Server 10.5.5
- Apple Mac OS X Server 10.5.6
- Apple QuickTime Player 7.0.0
- Apple QuickTime Player 7.0.1
- Apple QuickTime Player 7.0.2
- Apple QuickTime Player 7.0.3
- Apple QuickTime Player 7.0.4
- Apple QuickTime Player 7.1
- Apple QuickTime Player 7.1.1
- Apple QuickTime Player 7.1.2
- Apple QuickTime Player 7.1.3
- Apple QuickTime Player 7.1.4
- Apple QuickTime Player 7.1.5
- Apple QuickTime Player 7.1.6
- Apple QuickTime Player 7.2
- Apple QuickTime Player 7.3
- Apple QuickTime Player 7.3.1
- Apple QuickTime Player 7.3.1.70
- Apple QuickTime Player 7.4
- Apple QuickTime Player 7.4.1
- Apple QuickTime Player 7.4.5
- Apple QuickTime Player 7.5
- Apple QuickTime Player 7.5.5
- Apple QuickTime Player 7.6
- Apple QuickTime Player 7.6.1
References
- BugTraq: 34938
- CVE: CVE-2009-0010