Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Производитель ПО
Наименование ПО
QuickTime Player
(0, 7.0.4)
Описание
В QuickTime существует возможность вызвать переполнение. QuickTime некорректно проверяет границы данных в PICT-файле, что приводит к переполнению стека или динамической памяти. С помощью специально сформированного файла злоумышленник может выполнить произвольный код.
Как исправить
Для устранения уязвимости необходимо установить последнюю версию продукта, соответствующую используемой платформе. Необходимую информацию можно получить по адресу:
http://www.apple.com/
http://www.apple.com/
Ссылки
APPLE (APPLE-SA-2006-01-10): http://docs.info.apple.com/article.html?artnum=303101
BID (16202): http://www.securityfocus.com/bid/16202
FRSIRT (ADV-2006-0128): http://www.frsirt.com/english/advisories/2006/0128
BUGTRAQ (20060111 [EEYEB-20051220] Apple QuickTime QTIF Stack Overflow): http://www.securityfocus.com/archive/1/archive/1/421566/100/0/threaded
BUGTRAQ (20060111 Updated Advisories - Incorrect CVE Information): http://www.securityfocus.com/archive/1/archive/1/421547/100/0/threaded
FULLDISC (20060111 [CIRT.DK] Apple QuickTime 7.0.3 and earlier - JPG/PICT Buffer Overflow): http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0392.html
http://www.cirt.dk/advisories/cirt-41-advisory.pdf
CERT-VN (VU#629845): http://www.kb.cert.org/vuls/id/629845
CERT (TA06-011A): http://www.us-cert.gov/cas/techalerts/TA06-011A.html
CERT-VN (VU#687201): http://www.kb.cert.org/vuls/id/687201
BID (16212): http://www.securityfocus.com/bid/16212
OSVDB (22333): http://www.osvdb.org/22333
OSVDB (22334): http://www.osvdb.org/22334
OSVDB (22335): http://www.osvdb.org/22335
SECTRACK (1015463): http://securitytracker.com/id?1015463
XF (quicktime-qtif-bo(24054)): http://xforce.iss.net/xforce/xfdb/24054
FULLDISC (20060111 Updated Advisories - Incorrect CVE Information): http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0402.html
FULLDISC (20060111 [EEYEB-20051220] Apple QuickTime QTIF Stack Overflow): http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0398.html
BID (16202): http://www.securityfocus.com/bid/16202
FRSIRT (ADV-2006-0128): http://www.frsirt.com/english/advisories/2006/0128
BUGTRAQ (20060111 [EEYEB-20051220] Apple QuickTime QTIF Stack Overflow): http://www.securityfocus.com/archive/1/archive/1/421566/100/0/threaded
BUGTRAQ (20060111 Updated Advisories - Incorrect CVE Information): http://www.securityfocus.com/archive/1/archive/1/421547/100/0/threaded
FULLDISC (20060111 [CIRT.DK] Apple QuickTime 7.0.3 and earlier - JPG/PICT Buffer Overflow): http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0392.html
http://www.cirt.dk/advisories/cirt-41-advisory.pdf
CERT-VN (VU#629845): http://www.kb.cert.org/vuls/id/629845
CERT (TA06-011A): http://www.us-cert.gov/cas/techalerts/TA06-011A.html
CERT-VN (VU#687201): http://www.kb.cert.org/vuls/id/687201
BID (16212): http://www.securityfocus.com/bid/16212
OSVDB (22333): http://www.osvdb.org/22333
OSVDB (22334): http://www.osvdb.org/22334
OSVDB (22335): http://www.osvdb.org/22335
SECTRACK (1015463): http://securitytracker.com/id?1015463
XF (quicktime-qtif-bo(24054)): http://xforce.iss.net/xforce/xfdb/24054
FULLDISC (20060111 Updated Advisories - Incorrect CVE Information): http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0402.html
FULLDISC (20060111 [EEYEB-20051220] Apple QuickTime QTIF Stack Overflow): http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0398.html
