PT-2007-1552 · Apple · Apple Quicktime

Pdp · Publicado 2007-01-05 · Atualizado 2018-10-30 · CVE-2007-0059

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apple Quicktime versions 3 to 7.1.3

Description A cross-zone scripting issue allows remote user-assisted attackers to execute arbitrary code and list filesystem contents via a QuickTime movie (.MOV) with an HREF Track (HREFTrack) that contains an automatic action tag with a local URI. This is executed in a local zone during preview.

Recommendations For Apple Quicktime versions 3 to 7.1.3, consider disabling the automatic execution of local URIs in HREF Tracks as a temporary workaround until a patch is available. Restrict access to QuickTime movies with potentially malicious HREF Tracks to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2007-0059

Produtos afetados

Apple Quicktime

Referências · 8

• 🔥 https://exploit-db.com/exploits/3077 · Exploit
• 🔥 http://projects.info-pull.com/moab/MOAB-03-01-2007.html · Exploit
• http://gnucitizen.org/blog/backdooring-quicktime-movies · Aviso do Fabricante
• http://lists.apple.com/archives/Security-announce/2007/Mar/msg00000.html · Aviso do Fabricante
• http://kb.cert.org/vuls/id/304064 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-0059 · Nota de Segurança
• http://osvdb.org/31164 · Nota
• http://docs.info.apple.com/article.html?artnum=305149 · Nota