PT-2005-3636 · Apple · Apple Quicktime

Piotr Bania · Published 2005-11-05 · Updated 2018-10-19 · CVE-2005-2754

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apple QuickTime versions prior to 7.0.3

Description The issue is related to an integer overflow that occurs when processing a crafted MOV file with improper movie attributes. This allows attackers to potentially execute arbitrary code. A local overflow exists due to the failure to validate movie attributes in a file, resulting in an integer overflow. With a specially crafted file, an attacker can cause a large memory copy, leading to a loss of integrity.

Recommendations For Apple QuickTime versions prior to 7.0.3, update to version 7.0.3 or later to resolve the issue. As a temporary workaround, consider avoiding the use of crafted MOV files with improper movie attributes until a patch is applied. Restrict access to potentially vulnerable movie files to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2005-2754

Affected Products

Apple Quicktime

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2005-2754 · Security Note
• http://secunia.com/advisories/17428 · Vendor Advisory
• http://securitytracker.com/id?1015152 · Vendor Advisory
• http://pb.specialised.info/all/adv/quicktime-mov-io2-adv.txt · Vendor Advisory
• http://vupen.com/english/advisories/2005/2293 · Vendor Advisory
• http://osvdb.org/20476 · Note
• http://docs.info.apple.com/article.html?artnum=302772 · Note
• http://securityfocus.com/archive/1/archive/1/415709/30/0/threaded · Note
• http://frsirt.com/english/advisories/2005/2293 · Note
• http://securityfocus.com/archive/1/415709/30/0/threaded · Note
• http://securityfocus.com/bid/15308 · Note