English
The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1

Apple QuickTime Multiple Vulnerabilities


Secunia ID

SA46618

CVE-ID

CVE-2011-3218, CVE-2011-3219, CVE-2011-3220, CVE-2011-3221, CVE-2011-3222, CVE-2011-3223, CVE-2011-3228, CVE-2011-3247, CVE-2011-3248, CVE-2011-3249, CVE-2011-3250, CVE-2011-3251

Release Date

27 Oct 2011

Last Change

06 Jan 2012

Criticality

Highly Critical

Solution Status

Vendor Patch

Software

Apple QuickTime 7.x

Where

From remote

Impact
System access

This covers vulnerabilities where malicious people are able to gain system access and execute arbitrary code with the privileges of a local user.

Cross-Site Scripting

Cross-Site Scripting vulnerabilities allow a third party to manipulate the content or behaviour of a web application in a user's browser, without compromising the underlying system.

Different Cross-Site Scripting related vulnerabilities are also classified under this category, including "script insertion" and "cross-site request forgery".

Cross-Site Scripting vulnerabilities are often used against specific users of a website to steal their credentials or to conduct spoofing attacks.

Exposure of sensitive information

Vulnerabilities where documents or credentials are leaked or can be revealed either locally or from remote.

Description

Multiple vulnerabilities have been reported in Apple Quicktime, which can be exploited by malicious people to compromise a user's system.

For more information:
SA46339
SA46417

1) An integer overflow error when handling PICT files can be exploited via a specially crafted .pict file.

2) A signedness error when parsing font names embedded within an atom in RLE encoded samples can be exploited to cause a buffer overflow via a specially crafted movie file.

3) An error when handling FLC Delta Decompression blocks in FLIC files can be exploited to cause a buffer overflow via a specially crafted file.

4) An integer overflow error when processing the Coding Style Default (COD) marker segment can be exploited to cause a buffer overflow via a specially crafted JPEG2000 file.

5) An error when handling TKHD atoms within QuickTime movie files can be exploited to cause a buffer underflow via a specially crafted movie file.

Note: The vulnerabilities #1 and #5 do not affect Mac OS X versions.

Solution

Update to version 7.7.1.
http://support.apple.com/kb/DL837

Reported by

1, 2, 4) Luigi Auriemma via ZDI.
3) Matt 'j00ru' Jurczyk via ZDI.
4) An anonymous person via ZDI.
5) Damian Put via ZDI.

Original Advisory

Apple:
http://support.apple.com/kb/HT5016

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-11-314/
http://www.zerodayinitiative.com/advisories/ZDI-11-315/
http://www.zerodayinitiative.com/advisories/ZDI-11-316/
http://www.zerodayinitiative.com/advisories/ZDI-11-340/
http://www.zerodayinitiative.com/advisories/ZDI-12-004/
http://www.zerodayinitiative.com/advisories/ZDI-12-005/