PT-2007-1512 · Apple · Apple Quicktime

Kevin Finisterre + 1 · Published 2007-01-01 · Updated 2017-10-19 · CVE-2007-0015

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apple QuickTime version 7.1.3

Description A buffer overflow issue exists, allowing remote attackers to execute arbitrary code via a long rtsp:// URI. The rtsp:// handler fails to validate a supplied URL string, resulting in a stack overflow. With a specially crafted URL, an attacker can cause arbitrary code execution, leading to a loss of integrity.

Recommendations For Apple QuickTime version 7.1.3, consider disabling the rtsp:// handler until a patch is available to prevent potential exploitation. Restrict access to the vulnerable module to minimize the risk of arbitrary code execution. Avoid using long rtsp:// URIs in the affected QuickTime version until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2007-0015

Affected Products

Apple Quicktime

References · 22

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/apple_quicktime_rtsp.rb · Exploit
• 🔥 http://securitytracker.com/id?1017461 · Exploit
• 🔥 https://exploit-db.com/exploits/16527 · Exploit
• 🔥 https://exploit-db.com/exploits/3072 · Exploit
• 🔥 http://securityfocus.com/bid/21829 · Exploit
• 🔥 https://exploit-db.com/exploits/3064 · Exploit
• 🔥 http://projects.info-pull.com/moab/MOAB-01-01-2007.html · Exploit
• http://lists.apple.com/archives/Security-announce/2007/Jan/msg00000.html · Vendor Advisory
• http://kb.cert.org/vuls/id/442497 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-0015 · Security Note
• http://secunia.com/advisories/23540 · Vendor Advisory
• http://milw0rm.com/exploits/3064 · Note
• http://vupen.com/english/advisories/2007/0001 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31203 · Note
• http://frsirt.com/english/advisories/2007/0001 · Note