PT-2006-5189 · Apple · Apple Quicktime

Mike Price · Published 2006-09-12 · Updated 2018-10-17 · CVE-2006-4385

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apple QuickTime versions prior to 7.1.3

Description The issue is related to a buffer overflow that can be triggered by a crafted SGI image, allowing remote attackers to execute arbitrary code. This is due to the program's failure to validate SGI files properly, resulting in a buffer overflow. With a specially crafted file, an attacker can cause arbitrary code execution, leading to a loss of integrity.

Recommendations For Apple QuickTime versions prior to 7.1.3, update to version 7.1.3 or later to resolve the issue. As a temporary workaround, consider avoiding the use of SGI files until the update is applied. Restrict access to untrusted SGI files to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-4385

Affected Products

Apple Quicktime

References · 17

• http://securityfocus.com/bid/19976 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-4385 · Security Note
• http://security.gentoo.org/glsa/glsa-200803-08.xml · Vendor Advisory
• http://secunia.com/advisories/29182 · Note
• http://lists.apple.com/archives/Security-announce/2006/Sep/msg00000.html · Patch, Vendor Advisory
• http://frsirt.com/english/advisories/2006/3577 · Note
• http://securityfocus.com/archive/1/445888/100/0/threaded · Note
• http://securityreason.com/securityalert/1554 · Note
• http://osvdb.org/28768 · Note
• http://xforce.iss.net/xforce/xfdb/28932 · Note
• http://kb.cert.org/vuls/id/308204 · Note
• http://secunia.com/advisories/21893 · Note
• http://vupen.com/english/advisories/2006/3577 · Note
• http://securityfocus.com/archive/1/archive/1/445888/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28932 · Note