Apple Updates for Multiple Vulnerabilities
http://jvnrss.ise.chuo-u.ac.jp/jtg/trn/en/TRTA08-094A.html
JVNRSS based Status Tracking Notes: Apple QuickTime contains multiple vulnerabilities as described in the Apple Knowledgebase article HT1241. Exploitation of these vulnerabilities could allow a remote attacker to execute arbitrary code or cause a denial-of-service condition.JVNRSS Feasibility Study Teamjvn@jvn.jpTRTA08-094A2008-04-14T11:20+00:002008-04-14T11:20+00:002008-04-14T11:20+00:00Apple Releases QuickTime 7.4.5
http://www.us-cert.gov/current/archive/2008/04/03/archive.html#apple_releases_quicktime_7_4
US-CERT Current Activity
Apple has released QuickTime 7.4.5 to address multiple vulnerabilities. These vulnerabilities may allow a remote attacker to execute arbitrary code or obtain sensitive information.
US-CERThttp://www.uscert.gov/cas/techalerts/TA08-094A.html2008-04-03T20:54-04:002008-04-03T20:54-04:002008-04-03T20:54-04:00Apple Updates for Multiple Vulnerabilities
http://www.us-cert.gov/cas/techalerts/TA08-094A.html
Via US-CERT Mailing List
US-CERTTA08-094Ahttp://www.uscert.gov/cas/techalerts/TA08-094A.html2008-04-03T15:54-04:002008-04-03T15:54-04:002008-04-03T15:54-04:00A bag of vulnerabilities (and fixes) in QuickTime
http://isc.sans.org/diary.html?storyid=4232
Apple released QuickTime version 7.4.5 which addresses 11 vulnerabilities. Vulnerabilities range from denial of service attacks, information leaks to (of course) remote code execution.
SANS Internet Storm Centerhttp://www.us-cert.gov/cas/techalerts/TA08-094A.htmlhttp://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1013http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1014http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1015http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1016http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1017http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1018http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1019http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1020http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1021http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1022http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-10232008-04-03T12:14+00:002008-04-03T12:14+00:002008-04-03T12:14+00:00About the security content of QuickTime 7.4.5
http://support.apple.com/kb/HT1241
This document describes the security content of QuickTime 7.4.5.
AppleApple knowledgebase article HT1241http://www.us-cert.gov/cas/techalerts/TA08-094A.htmlhttp://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1013http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1014http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1015http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1016http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1017http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1018http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1019http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1020http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1021http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1022http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-10232008-04-032008-04-032008-04-03Apple QuickTime Kodak Encoding Heap Overflow Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-08-017/
Kodak Encoding Heap Overflow Vulnerability (CVE-2008-1020)
Vulnerability Reported
The specific flaw exists within the quicktime.qts library responsible for parsing Kodak encoded images. A lack of proper error checking can result in a heap based buffer overflow leading to arbitrary code execution under the context of the currently logged in user.
Zero Day Initiative (ZDI)ZDI-08-017http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-10202008-02-072008-02-072008-02-07Apple QuickTime MP4A Atom Parsing Heap Corruption Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-08-016/
MP4A Atom Parsing Heap Overflow Vulnerability (CVE-2008-1018)
Vulnerability Reported
The specific flaw exists in the parsing of the QuickTime Channel Compositor atom. When the movie file contains a malformed 'chan' atom, a heap corruption occurs resulting in the execution of arbitrary code.
Zero Day Initiative (ZDI)ZDI-08-016http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-10182008-02-072008-02-072008-02-07Apple QuickTime Clipping Region Heap Overflow Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-08-015/
Clipping Region Heap Overflow Vulnerability (CVE-2008-1017)
Vulnerability Reported
The specific flaw exists within the quicktime.qts library. The vulnerability resides in the component's parsing of 'crgn' atoms. A lack of proper sanity checks on the region size field can result in a heap based buffer overflow leading to arbitrary code execution under the context of the currently logged in user.
Zero Day Initiative (ZDI)ZDI-08-015http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-10172008-02-072008-02-072008-02-07Apple Quicktime Multiple Opcode Memory Corruption Vulnerabilities
http://www.zerodayinitiative.com/advisories/ZDI-08-014/
Opcode Memory Corruption Vulnerabilities (CVE-2008-1019)
Vulnerability Reported
The specific flaw exists in the quickTime.qts while parsing corrupted .pict files. The module contains a vulnerable memory copy loop which searches for a terminator value. When this value is changed or omitted, a heap corruption occurs allowing the execution of arbitrary code.
Zero Day Initiative (ZDI)ZDI-08-014http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-10192008-02-072008-02-072008-02-07Apple QuickTime Malformed VR obji Atom Parsing Memory Corruption Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-08-019/
obji Atom Parsing Memory Corruption Vulnerability (CVE-2008-1022)
Vulnerability Reported
The specific flaw exists in the parsing of the QuickTime VR 'obji' atom. When the size of the atom is set to 0, a stack overflow condition occurs resulting in the execution of arbitrary code.
Zero Day Initiative (ZDI)ZDI-08-019http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-10222008-02-072008-02-072008-02-07Apple QuickTime Run Length Encoding Heap Overflow Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-08-018/
Run Length Encoding Heap Overflow Vulnerability (CVE-2008-1021)
Vulnerability Reported
The specific flaw exists within the parsing of QuickTime files that utilize the Animation codec. A lack of proper length checks can result in a heap based buffer overflow leading to arbitrary code execution under the context of the currently logged in user.
Zero Day Initiative (ZDI)ZDI-08-018http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-10212008-02-072008-02-072008-02-07B2yKHUMG/ya3DPzRlTusg+kWo54=YcAGIfcUFpM02XTiztrxfCClui4=YyeXRPrO8/Wg2DD+mhHSCNwBgJwkK6vb/Fux+xUXzec107l13zLrc+002y6q34WYwyjUr2L+IyygMf43KSfKjfA07VKDBdLLEqO3M3wy+7UwwALkMRqF3bxQG8o6GgVIx9NgHKnL3pWKDB7N3TWYk5a1xhL3VbWC1rNQGStpdzA=MIIE1DCCA7ygAwIBAgIQfBHY/s5/LRzGChqXgtjCKTANBgkqhkiG9w0BAQUFADCB3TELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2UgYXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykwNTEeMBwGA1UECxMVUGVyc29uYSBOb3QgVmFsaWRhdGVkMTcwNQYDVQQDEy5WZXJpU2lnbiBDbGFzcyAxIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQSAtIEcyMB4XDTA3MDcwNTAwMDAwMFoXDTA4MDcwNDIzNTk1OVowggEhMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazFGMEQGA1UECxM9d3d3LnZlcmlzaWduLmNvbS9yZXBvc2l0b3J5L1JQQSBJbmNvcnAuIGJ5IFJlZi4sTElBQi5MVEQoYyk5ODEeMBwGA1UECxMVUGVyc29uYSBOb3QgVmFsaWRhdGVkMTQwMgYDVQQLEytEaWdpdGFsIElEIENsYXNzIDEgLSBNaWNyb3NvZnQgRnVsbCBTZXJ2aWNlMSYwJAYDVQQDFB1KVk5SU1MgRmVhc2liaWxpdHkgU3R1ZHkgVGVhbTEfMB0GCSqGSIb3DQEJARYQanZucnNzQGlwYS5nby5qcDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAsCjiweXb23sjKQajfCS8WiHjax1ppkfkjhN/SwBp/LOOXlpZpzW/lHtKSnWJLPOZzLxIJUWARTZ+T2y2wCzDnKU9TOkNx56u7iBhhATVRyPby22uRY0Pf+1uu8vnSZPvAR50FI9o2COo9xCqfXZWU/RNWSrsrxJd2XL4Y6sYzL0CAwEAAaOBzDCByTAJBgNVHRMEAjAAMEQGA1UdIAQ9MDswOQYLYIZIAYb4RQEHFwMwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYTALBgNVHQ8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwQGCCsGAQUFBwMCMEoGA1UdHwRDMEEwP6A9oDuGOWh0dHA6Ly9JbmRDMURpZ2l0YWxJRC1jcmwudmVyaXNpZ24uY29tL0luZEMxRGlnaXRhbElELmNybDANBgkqhkiG9w0BAQUFAAOCAQEAHbEsHsaKt3O4OUlcec2BOe+MAP4eGW5X494WdegnLEW4tlAxZvctmLeGr0VRXMtF1JumpTLQcdQvUFp15N2+RDa1PrMFrkrCz9BdextE/7mykda0DzsAvbroqHbsu3tZOhnE7T61ZxtBuXOC0jChphl96yDn8NxvebCwcApB46oeKSbAFT21HRIWGiCo1QaMvB390MzFfOFfft1oHivREyIjgXNyAUSTunj/rQhodTnQRVdRuVwa5KSUErWOnNFM2uuXaF/vJqVRX2QR6zr+S+JGbw3ykc/7zkixEBbkSv3wOTh7BmsXRzRvLcaD92ifxOqFxWHQxIqMSxsbJ6WyPQ==