PT-2006-2464 · Apple · Quicktime Streaming Server

Publicado 2006-05-12 · Atualizado 2017-07-20 · CVE-2006-1456

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions QuickTime Streaming Server versions 10.3.9 through 10.4.6

Description The issue is related to a buffer overflow in the QuickTime Streaming Server, which can be exploited by remote attackers through a crafted RTSP request. This request is not properly handled during message logging, allowing attackers to execute arbitrary code.

Recommendations For versions 10.3.9 through 10.4.6, consider restricting access to the RTSP endpoint until a patch is available. As a temporary workaround, disabling the logging of RTSP requests may help minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-1456

Produtos afetados

Quicktime Streaming Server

Referências · 9

• http://lists.apple.com/archives/security-announce/2006/May/msg00003.html · Correção, Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-1456 · Nota de Segurança
• http://securityfocus.com/bid/17951 · Nota
• http://us-cert.gov/cas/techalerts/TA06-132A.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26424 · Nota
• http://osvdb.org/25600 · Nota
• http://secunia.com/advisories/20077 · Nota
• http://securitytracker.com/id?1016070 · Nota
• http://vupen.com/english/advisories/2006/1779 · Nota