PT-2007-3721 · Apple · Quicktime For Java

Publicado 2007-05-29 · Atualizado 2011-05-18 · CVE-2007-2388

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apple QuickTime for Java version 7.1.6

Description The issue allows remote attackers to execute arbitrary code via a web page containing a user-defined class that accesses unsafe functions, which can be leveraged to write to arbitrary memory locations. A buffer overflow exists due to the failure to validate applets, resulting in a heap overflow. This can lead to arbitrary code execution, resulting in a loss of integrity.

Recommendations For Apple QuickTime for Java version 7.1.6, consider disabling the QTObject subclassing feature as a temporary workaround until a patch is available. Restrict access to unsafe functions that can be leveraged to write to arbitrary memory locations to minimize the risk of exploitation. Avoid using specially crafted applets in QuickTime for Java until the issue is resolved.

Correção

RCE

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2007-2388

Produtos afetados

Quicktime For Java

Referências · 9

• http://osvdb.org/35576 · Nota
• http://securityfocus.com/bid/24221 · Nota
• http://vupen.com/english/advisories/2007/1974 · Aviso do Fabricante
• http://secunia.com/secunia_research/2007-52/advisory · Aviso do Fabricante
• http://lists.apple.com/archives/security-announce/2007/May/msg00005.html · Aviso do Fabricante
• http://securitytracker.com/id?1018136 · Nota
• http://kb.cert.org/vuls/id/995836 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-2388 · Nota de Segurança
• http://secunia.com/advisories/25130 · Aviso do Fabricante