PT-2005-4466 · Apple · Apple Quicktime
Published
2005-12-31
·
Updated
2018-10-19
·
CVE-2005-3711
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Apple Quicktime versions prior to 7.0.4
Description
The issue is related to an integer overflow in the processing of TIFF image files. This overflow occurs due to incorrect boundary checking of integer values, specifically in the 'height', 'width', 'strips', and 'bands' fields of a TIFF image. An attacker can potentially execute arbitrary code by crafting a special request, leading to a loss of integrity.
Recommendations
For Apple Quicktime versions prior to 7.0.4, update to version 7.0.4 or later to resolve the issue. As a temporary workaround, consider avoiding the use of TIFF image files with modified 'strips' or 'bands' values until the update is applied. Restrict access to potentially vulnerable API endpoints related to image processing to minimize the risk of exploitation.
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apple Quicktime