Multiple buffer overflows in Apple QuickTime before 7.1 allow remote attackers to execute arbitrary code via a crafted QuickTime movie (.MOV), as demonstrated via a large size for a udta Atom.

The remote Windows host is running a version of QuickTime prior to 7.1. 

The remote version of QuickTime is vulnerable to various integer and buffer overflows involving specially crafted image and media files. An attacker may be able to leverage these issues to execute arbitrary code on the remote host by sending a malformed file to a victim and having him open it using QuickTime player.

The remote Mac OS X host is running a version of Quicktime prior to 7.1. 

The remote version of Quicktime is vulnerable to various integer and buffer overflows involving specially crafted image and media files. An attacker may be able to leverage these issues to execute arbitrary code on the remote host by sending a malformed file to a victim and having him open it using QuickTime player.

The remote host is running Apple Mac OS X, but lacks Security Update 2006-003. This security update contains fixes for the following applications :
AppKit
ImageIO
BOM
CFNetwork
ClamAV (Mac OS X Server only)
CoreFoundation
CoreGraphics
Finder
FTPServer
Flash Player
KeyChain
LaunchServices
libcurl
Mail
MySQL Manager (Mac OS X Server only)
Preview
QuickDraw
QuickTime Streaming Server
Ruby
Safari

The remote Mac OS X host is running a version of Quicktime prior to 7.1.  The remote version of Quicktime is vulnerable to various integer and buffer overflows involving specially-crafted image and media files.  An attacker may be able to leverage these issues to execute arbitrary code on the remote host by sending a malformed file to a victim and having it opened using QuickTime player.

ID	Name	Product	Family	Severity
21556	QuickTime < 7.1 Multiple Vulnerabilities (Windows)	Nessus	Windows	high
21554	Quicktime < 7.1 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
3617	Mac OS X Multiple Vulnerabilities (Security Update 2006-003)	Nessus Network Monitor	Operating System Detection	medium
3616	Quicktime < 7.1 on Mac OS X Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
801197	Quicktime < 7.1 on Mac OS X Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high

Detections

Analytics

CVE-2006-1460

critical

Tenable Plugins

high

high

medium

high

high