PT-2006-5188 · Apple · Apple Quicktime

Mike Price + 1 · Published 2006-09-12 · Updated 2018-10-17 · CVE-2006-4384

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apple QuickTime versions prior to 7.1.3

Description The issue is related to a heap-based buffer overflow that can be triggered by a specially crafted FLC movie file, specifically through the COLOR 64 chunk. This allows remote attackers to execute arbitrary code, resulting in a loss of integrity. The problem arises from the program's failure to properly validate FLC files, leading to a heap buffer overflow.

Recommendations For Apple QuickTime versions prior to 7.1.3, update to version 7.1.3 or later to resolve the issue. As a temporary workaround, consider avoiding the use of FLC files or restricting access to potentially malicious files until the update can be applied.

Exploit

Fix

Related Identifiers

CVE-2006-4384

Affected Products

Apple Quicktime

References · 23

• 🔥 http://securityfocus.com/bid/19976 · Exploit
• 🔥 https://exploit-db.com/exploits/28521 · Exploit
• http://security.gentoo.org/glsa/glsa-200803-08.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-4384 · Security Note
• http://idefense.com/intelligence/vulnerabilities/display.php?id=413 · Vendor Advisory
• http://secunia.com/advisories/29182 · Note
• http://lists.apple.com/archives/Security-announce/2006/Sep/msg00000.html · Patch, Vendor Advisory
• http://frsirt.com/english/advisories/2006/3577 · Note
• http://securityfocus.com/archive/1/445888/100/0/threaded · Note
• http://kb.cert.org/vuls/id/489836 · Note
• http://securityreason.com/securityalert/1554 · Note
• http://osvdb.org/28771 · Note
• http://securityfocus.com/archive/1/446134/100/0/threaded · Note
• http://xforce.iss.net/xforce/xfdb/28930 · Note
• http://reversemode.com/index.php?option=com_remository&Itemid=2&func=fileinfo&id=25 · Note