PT-2008-2396 · Apple · Apple Quicktime+1

Laurent Gaffiã© · Published 2008-02-14 · Updated 2018-10-15 · CVE-2008-0778

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apple QuickTime versions 7.4.1 and earlier

Description The issue is related to multiple stack-based buffer overflows in an ActiveX control in QTPlugin.ocx. This can be exploited by remote attackers who send long arguments to certain methods, potentially causing a denial of service (crash) and possibly allowing the execution of arbitrary code. The methods affected include SetBgColor, SetHREF, SetMovieName, SetTarget, and SetMatrix.

Recommendations For Apple QuickTime versions 7.4.1 and earlier, update to a version later than 7.4.1 to resolve the issue.

Exploit

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2008-0778

Affected Products

Apple Quicktime

Qtplugin.Ocx

References · 8

• 🔥 https://exploit-db.com/exploits/5110 · Exploit
• 🔥 http://securityfocus.com/bid/27769 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0778 · Security Note
• http://securityfocus.com/archive/1/archive/1/488045/100/0/threaded · Note
• http://securityreason.com/securityalert/3652 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/40475 · Note
• http://securityfocus.com/archive/1/488045/100/0/threaded · Note
• http://milw0rm.com/exploits/5110 · Note