PT-2003-1339 · Apple · Quicktime Streaming Server+1

Ollie Whitehouse · Published 2003-03-07 · Updated 2016-10-18 · CVE-2003-0054

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apple Darwin Streaming Administration Server version 4.1.2 Apple QuickTime Streaming Server version 4.1.1

Description The issue allows remote attackers to execute certain code via a request to port 7070 with the script in an argument to the rtsp DESCRIBE method. This script is inserted into a log file and executed when the log is viewed using a browser.

Recommendations For Apple Darwin Streaming Administration Server version 4.1.2, consider restricting access to port 7070 to minimize the risk of exploitation. For Apple QuickTime Streaming Server version 4.1.1, avoid using the rtsp DESCRIBE method with untrusted input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2003-0054

Affected Products

Apple Darwin Streaming Administration Server

Quicktime Streaming Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2003-0054 · Security Note
• http://iss.net/security_center/static/11405.php · Vendor Advisory
• http://securityfocus.com/bid/6960 · Note
• http://lists.apple.com/archives/security-announce/2003/Feb/25/applesa20030225macosx102.txt · Note
• http://marc.info/?l=bugtraq&m=104618904330226&w=2 · Note