Apple QuickTime Multiple Vulnerabilities

SA46618

CVE-2011-3218, CVE-2011-3219, CVE-2011-3220, CVE-2011-3221, CVE-2011-3222, CVE-2011-3223, CVE-2011-3228, CVE-2011-3247, CVE-2011-3248, CVE-2011-3249, CVE-2011-3250, CVE-2011-3251

27 Oct 2011

06 Jan 2012

Highly Critical

Vendor Patch

Apple QuickTime 7.x

From remote

System access

This covers vulnerabilities where malicious people are able to gain system access and execute arbitrary code with the privileges of a local user.

Cross-Site Scripting

Cross-Site Scripting vulnerabilities allow a third party to manipulate the content or behaviour of a web application in a user's browser, without compromising the underlying system.

Different Cross-Site Scripting related vulnerabilities are also classified under this category, including "script insertion" and "cross-site request forgery".

Cross-Site Scripting vulnerabilities are often used against specific users of a website to steal their credentials or to conduct spoofing attacks.

Exposure of sensitive information

Vulnerabilities where documents or credentials are leaked or can be revealed either locally or from remote.

Multiple vulnerabilities have been reported in Apple Quicktime, which can be exploited by malicious people to compromise a user's system.

For more information:
SA46339
SA46417

1) An integer overflow error when handling PICT files can be exploited via a specially crafted .pict file.

2) A signedness error when parsing font names embedded within an atom in RLE encoded samples can be exploited to cause a buffer overflow via a specially crafted movie file.

3) An error when handling FLC Delta Decompression blocks in FLIC files can be exploited to cause a buffer overflow via a specially crafted file.

4) An integer overflow error when processing the Coding Style Default (COD) marker segment can be exploited to cause a buffer overflow via a specially crafted JPEG2000 file.

5) An error when handling TKHD atoms within QuickTime movie files can be exploited to cause a buffer underflow via a specially crafted movie file.

Note: The vulnerabilities #1 and #5 do not affect Mac OS X versions.

Update to version 7.7.1.
http://support.apple.com/kb/DL837

1, 2, 4) Luigi Auriemma via ZDI.
3) Matt 'j00ru' Jurczyk via ZDI.
4) An anonymous person via ZDI.
5) Damian Put via ZDI.

Apple:
http://support.apple.com/kb/HT5016

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-11-314/
http://www.zerodayinitiative.com/advisories/ZDI-11-315/
http://www.zerodayinitiative.com/advisories/ZDI-11-316/
http://www.zerodayinitiative.com/advisories/ZDI-11-340/
http://www.zerodayinitiative.com/advisories/ZDI-12-004/
http://www.zerodayinitiative.com/advisories/ZDI-12-005/