PT-2006-2464 · Apple · Quicktime Streaming Server

Published 2006-05-12 · Updated 2017-07-20 · CVE-2006-1456

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions QuickTime Streaming Server versions 10.3.9 through 10.4.6

Description The issue is related to a buffer overflow in the QuickTime Streaming Server, which can be exploited by remote attackers through a crafted RTSP request. This request is not properly handled during message logging, allowing attackers to execute arbitrary code.

Recommendations For versions 10.3.9 through 10.4.6, consider restricting access to the RTSP endpoint until a patch is available. As a temporary workaround, disabling the logging of RTSP requests may help minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-1456

Affected Products

Quicktime Streaming Server

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2006-1456 · Security Note
• http://lists.apple.com/archives/security-announce/2006/May/msg00003.html · Patch, Vendor Advisory
• http://securityfocus.com/bid/17951 · Note
• http://us-cert.gov/cas/techalerts/TA06-132A.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26424 · Note
• http://osvdb.org/25600 · Note
• http://secunia.com/advisories/20077 · Note
• http://securitytracker.com/id?1016070 · Note
• http://vupen.com/english/advisories/2006/1779 · Note