PT-2007-1552 · Apple · Apple Quicktime

Pdp · Published 2007-01-05 · Updated 2018-10-30 · CVE-2007-0059

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apple Quicktime versions 3 to 7.1.3

Description A cross-zone scripting issue allows remote user-assisted attackers to execute arbitrary code and list filesystem contents via a QuickTime movie (.MOV) with an HREF Track (HREFTrack) that contains an automatic action tag with a local URI. This is executed in a local zone during preview.

Recommendations For Apple Quicktime versions 3 to 7.1.3, consider disabling the automatic execution of local URIs in HREF Tracks as a temporary workaround until a patch is available. Restrict access to QuickTime movies with potentially malicious HREF Tracks to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2007-0059

Affected Products

Apple Quicktime

References · 8

• 🔥 https://exploit-db.com/exploits/3077 · Exploit
• 🔥 http://projects.info-pull.com/moab/MOAB-03-01-2007.html · Exploit
• http://gnucitizen.org/blog/backdooring-quicktime-movies · Vendor Advisory
• http://lists.apple.com/archives/Security-announce/2007/Mar/msg00000.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-0059 · Security Note
• http://kb.cert.org/vuls/id/304064 · Note
• http://osvdb.org/31164 · Note
• http://docs.info.apple.com/article.html?artnum=305149 · Note