Integer underflow in QuickDraw Manager in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7, and Apple QuickTime before 7.6.2, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PICT image with a crafted 0x77 Poly tag and a crafted length field, which triggers a heap-based buffer overflow.

The version of QuickTime installed on the remote Windows host is older than 7.6.2.  Such versions contain several vulnerabilities :

  - An integer underflow in QuickTime's handling of PICT     images may result in a heap-based buffer overflow and,     in turn, to an application crash or arbitrary code     execution. (CVE-2009-0010)

  - A heap-based buffer overflow in QuickTime's handling of     MS ADPCM encoded audio data may lead to an application     crash or arbitrary code execution. (CVE-2009-0185)

  - A memory corruption issue in QuickTime's handling of     Sorenson 3 video files may lead to an application crash     or arbitrary code execution. (CVE-2009-0188)

  - A heap-basded buffer overflow in QuickTime's handling of     FLC compression files may lead to an application crash     or arbitrary code execution. (CVE-2009-0951)

  - A buffer overflow in QuickTime's handling of compressed     PSD image files may lead to an application crash or     arbitrary code execution. (CVE-2009-0952)

  - A heap-based buffer overflow in QuickTime's handling of     PICT image files may lead to an application crash or     arbitrary code execution. (CVE-2009-0953)

  - A heap-based buffer overflow in QuickTime's handling of     Clipping Region (CRGN) atom types in a movie file may     lead to an application crash or arbitrary code     execution. (CVE-2009-0954)

  - A sign extension issue in QuickTime's handling of image     description atoms in an Apple video file may lead to an     application crash or arbitrary code execution.
    (CVE-2009-0955)

  - An uninitialized memory access issue in QuickTime's     handling of movie files may lead to an application     crash or arbitrary code execution. (CVE-2009-0956)

  - A heap-based buffer overflow in QuickTime's handling of     JP2 image files may lead to an application crash or     arbitrary code execution. (CVE-2009-0957)

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.7. 

Mac OS X 10.5.7 contains security fixes for the following products :

  - Apache
  - ATS
  - BIND
  - CFNetwork
  - CoreGraphics
  - Cscope
  - CUPS
  - Disk Images
  - enscript
  - Flash Player plug-in
  - Help Viewer
  - iChat
  - International Components for Unicode
  - IPSec
  - Kerberos
  - Kernel
  - Launch Services
  - libxml
  - Net-SNMP
  - Network Time
  - Networking
  - OpenSSL
  - PHP
  - QuickDraw Manager
  - ruby
  - Safari
  - Spotlight
  - system_cmds
  - telnet
  - Terminal
  - WebKit
  - X11

The remote host is running a version of Mac OS X 10.4 that does not have Security Update 2009-002 applied.

This security update contains fixes for the following products :

  - Apache
  - ATS
  - BIND
  - CoreGraphics
  - Cscope
  - CUPS
  - Disk Images
  - enscript
  - Flash Player plug-in
  - Help Viewer
  - IPSec
  - Kerberos
  - Launch Services
  - libxml
  - Net-SNMP
  - Network Time
  - OpenSSL
  - QuickDraw Manager
  - Spotlight
  - system_cmds
  - telnet
  - Terminal
  - X11

The version of QuickTime installed on the remote host is older than 7.6.2. Such versions contain multiple vulnerabilities : 

  - A memory corruption issue exists in QuickTime's handling of 'Sorenson 3' video files. (CVE-2009-0188)

  - A heap buffer overflow exists in the handling of 'FLC' compression files. (CVE-2009-0951)

  - A buffer overflow may occur when processing compressed 'PSD' images. (CVE-2009-0952)

  - An integer overflow exists in the handling of 'PICT' images could lead to a heap buffer overflow. (CVE-2009-0010), (CVE-2009-0953)

  - A heap buffer overflow could occur when handling 'Clipping Region' atom types in a movie file. (CVE-2009-0954)

  - A heap buffer overflow exists in the handling of 'MS ADPCM' encoded audio data. (CVE-2009-0185)

  - A sign extension issue exists in the handling of image description atoms. (CVE-2009-0955)

  - An uninitialized memory access issue exists when handling movie files with a zero user data atom size. (CVE-2009-0956)

  - A heap buffer overflow exists in the handling of 'JP2' images. (CVE-2009-0957)

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.7.  Mac OS X 10.5.7 contains security fixes for the following products : 

- Apache
- ATS
- BIND
- CFNetwork
- CoreGraphics
-Cscope
- CUPS
- Disk Images
- enscript
- Flash player
- Help Viewer
- iChat
- Internation Components for Unicode
- IPSec
- Kerberos
- Kernel
- Launch Services
- libxml
- Net-SNMP
- Network Time
- Networking
- OpenSSL
- PHP
- QuickDraw Manager
- ruby
- Safari
- Spotlight
- system_cmds
- telnet
- WebKit
- X11
- Terminal

ID	Name	Product	Family	Severity
38988	QuickTime < 7.6.2 Multiple Vulnerabilities (Windows)	Nessus	Windows	high
38744	Mac OS X 10.5.x < 10.5.7 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
38743	Mac OS X Multiple Vulnerabilities (Security Update 2009-002)	Nessus	MacOS X Local Security Checks	critical
5042	QuickTime < 7.6.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
5023	Mac OS X 10.5 < 10.5.7 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
801205	QuickTime < 7.6.2 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
800792	Mac OS X 10.5 < 10.5.7 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	high

Detections

Analytics

CVE-2009-0010

high

Tenable Plugins

high

critical

critical

medium

critical

high

high