PT-2003-1339 · Apple · Quicktime Streaming Server+1

Ollie Whitehouse · Publicado 2003-03-07 · Atualizado 2016-10-18 · CVE-2003-0054

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apple Darwin Streaming Administration Server version 4.1.2 Apple QuickTime Streaming Server version 4.1.1

Description The issue allows remote attackers to execute certain code via a request to port 7070 with the script in an argument to the rtsp DESCRIBE method. This script is inserted into a log file and executed when the log is viewed using a browser.

Recommendations For Apple Darwin Streaming Administration Server version 4.1.2, consider restricting access to port 7070 to minimize the risk of exploitation. For Apple QuickTime Streaming Server version 4.1.1, avoid using the rtsp DESCRIBE method with untrusted input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2003-0054

Produtos afetados

Apple Darwin Streaming Administration Server

Quicktime Streaming Server

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2003-0054 · Nota de Segurança
• http://securityfocus.com/bid/6960 · Nota
• http://lists.apple.com/archives/security-announce/2003/Feb/25/applesa20030225macosx102.txt · Nota
• http://marc.info/?l=bugtraq&m=104618904330226&w=2 · Nota
• http://iss.net/security_center/static/11405.php · Aviso do Fabricante