Apple QuickTime before 7.4.5 enables deserialization of QTJava objects by untrusted Java applets, which allows remote attackers to execute arbitrary code via a crafted applet.

The version of QuickTime installed on the remote Windows host is older than 7.4.5.   Such versions contain several vulnerabilities : 

  - Untrusted Java applets may obtain elevated privileges (CVE-2008-1013).
  - Downloading a movie file may lead to information disclosure (CVE-2008-1014).
  - Viewing a specially-crafted movie file may lead to a program crash or arbitrary code execution (CVE-2008-1015, CVE-2008-1016, CVE-2008-1017, CVE-2008-1018, CVE-2008-1021, CVE-2008-1022).
  - Opening a specially-crafted PICT image file may lead to a program crash or arbitrary code execution (CVE-2008-1019, CVE-2008-1020, CVE-2008-1023).

The version of QuickTime installed on the remote Mac OS X host is older than 7.4.5.  Such versions contain several vulnerabilities :

  - Untrusted Java applets may obtain elevated privileges     (CVE-2008-1013).

  - Downloading a movie file may lead to information     disclosure (CVE-2008-1014).

  - Viewing a specially crafted movie file may lead to a     program crash or arbitrary code execution     (CVE-2008-1015, CVE-2008-1016, CVE-2008-1017,     CVE-2008-1018, CVE-2008-1021, CVE-2008-1022).

  - Opening a specially crafted PICT image file may lead     to a program crash or arbitrary code execution     (CVE-2008-1019, CVE-2008-1020, CVE-2008-1023).

The version of QuickTime installed on the remote Windows host is older than 7.4.5.   Such versions contain several vulnerabilities :

  - Untrusted Java applets may obtain elevated privileges     (CVE-2008-1013).

  - Downloading a movie file may lead to information     disclosure (CVE-2008-1014).

  - Viewing a specially crafted movie file may lead to a     program crash or arbitrary code execution     (CVE-2008-1015, CVE-2008-1016, CVE-2008-1017,     CVE-2008-1018, CVE-2008-1021, CVE-2008-1022).

  - Opening a specially crafted PICT image file may lead     to a program crash or arbitrary code execution     (CVE-2008-1019, CVE-2008-1020, CVE-2008-1023).

ID	Name	Product	Family	Severity
4458	QuickTime < 7.4.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
31736	QuickTime < 7.4.5 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
31735	QuickTime < 7.4.5 Multiple Vulnerabilities (Windows)	Nessus	Windows	high
801195	QuickTime < 7.4.5 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high

Detections

Analytics

CVE-2008-1013

critical

Tenable Plugins

medium

high

high

high