QuickTime in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file that causes an image sample transformation to scale a sprite outside a buffer boundary.

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.8. This update contains security-related fixes for the following components :

  - App Store
  - ATS
  - Certificate Trust Policy
  - CoreFoundation
  - CoreGraphics
  - FTP Server
  - ImageIO
  - International Components for Unicode
  - Kernel
  - Libsystem
  - libxslt
  - MobileMe
  - MySQL
  - OpenSSL
  - patch
  - QuickLook
  - QuickTime
  - Samba
  - servermgrd
  - subversion

Versions of Mac OS X 10.6 earlier than 10.6.8 are potentially affected by a security issue.  Mac OS X 10.6.8 contains a security fix for the following products :

  - App Store

  - ATS

  - Certificate Trust Policy

  - CoreFoundation

  - CoreGraphics

  - FTP Server

  - ImageIO

  - International Components for Unicode

  - Kernel

  - Libsystem

  - libxslt

  - MobileMe

  - MySQL

  - OpenSSL

  - patch

  - QuickLook

  - QuickTime

  - Samba

  - servermgrd

  - subversion
IAVA Reference : 2011-A-0160
IAVB Reference : 2012-B-0038
STIG Finding Severity : Category I

Versions of Mac OS X 10.6 earlier than 10.6.8 are potentially affected by a security issue.  Mac OS X 10.6.8 contains a security fix for the following products :

  - App Store

  - ATS

  - Certificate Trust Policy

  - CoreFoundation

  - CoreGraphics

  - FTP Server

  - ImageIO

  - International Components for Unicode

  - Kernel

  - Libsystem

  - libxslt

  - MobileMe

  - MySQL

  - OpenSSL

  - patch

  - QuickLook

  - QuickTime

  - Samba

  - servermgrd

  - subversion

Versions of QuickTime earlier than 7.6.9 are potentially affected by multiple vulnerabilities :

  - A filesystem permission issue may allow a local user on a Windows system to access the contents of the 'Apple Computer' directory in the user's profile. (CVE-2010-0530)

  - A heap buffer overflow in QuickTime's handling of Track Header (tkhd) atoms may lead to an application crash or arbitrary code execution on Windows systems. (CVE-2010-1508)

  - A heap buffer overflow in Quicktime's handling of JP2 images may lead to an application crash or arbitrary code execution. (CVE-2010-3787)

  - Uninitialized memory access issue in QuickTime's handling of JP2, FlashPix, and GIF images may lead to an application crash or arbitrary code execution. (CVE-2010-3788, CVE-2010-3794, CVE-2010-3795)

  - Memory corruption issues in QuickTime's handling of AVI files, movie files, Sorenson encoded movie files, PICT files, FlashPix images, and panorama atoms in QTVR (QuickTime Virtual Reality) movie files may lead to an application crash or arbitrary code execution. (CVE-2010-3789, CVE-2010-3790, CVE-2010-3793, CVE-2010-3800, CVE-2010-3801, CVE-2010-3802)

  - A buffer overflow in QuickTime's handling of MPEG-encoded movie files may lead to an application crash or arbitrary code execution. (CVE-2010-3791)

  - A signedness issue in QuickTime's handling of MPEG-encoded movie files may lead to an application crash or arbitrary code execution. (CVE-2010-3792)

  - An integer overflow in QuickTime's handling of movie files may lead to an application crash or arbitrary code execution. (CVE-2010-4009)

The version of QuickTime installed on the remote Windows host is older than 7.6.9.  Such versions contain several vulnerabilities :

  - A filesystem permission issue may allow a local user     on a Windows system to access the contents of the     'Apple Computer' directory in the user's profile.
    (CVE-2010-0530)

  - A heap-based buffer overflow in QuickTime's handling of     Track Header (tkhd) atoms may lead to an application     crash or arbitrary code execution on Windows systems.
    (CVE-2010-1508)

  - A heap-based buffer overflow in QuickTime's handling of     JP2 images may lead to an application crash or arbitrary     code execution. (CVE-2010-3787)

  - Uninitialized memory access issues in QuickTime's     handling of JP2, FlashPix, and GIF images may lead to     an application crash or arbitrary code execution.
    (CVE-2010-3788, CVE-2010-3794, CVE-2010-3795)

  - Memory corruption issues in QuickTime's handling of     AVI files, movie files, Sorenson encoded movie files,     PICT files, FlashPix images, and panorama atoms in QTVR     (QuickTime Virtual Reality) movie files may lead to an     application crash or arbitrary code execution.
    (CVE-2010-3789, CVE-2010-3790, CVE-2010-3793,     CVE-2010-3800, CVE-2010-3801, CVE-2010-3802)

  - A buffer overflow in QuickTime's handling of MPEG-     encoded movie files may lead to an application crash or     arbitrary code execution. (CVE-2010-3791)

  - A signedness issue in QuickTime's handling of MPEG-     encoded movie files may lead to an application crash or     arbitrary code execution. (CVE-2010-3792)

  - An integer overflow in QuickTime's handling of movie     files may lead to an application crash or arbitrary     code execution. (CVE-2010-4009)

The version of QuickTime installed on the remote Mac OS X host is older than 7.6.9.  Such versions contain several vulnerabilities :

  - A heap buffer overflow in QuickTime's handling of JP2     images may lead to an application crash or arbitrary     code execution. (CVE-2010-3787)

  - Uninitialized memory access issues in QuickTime's     handling of JP2, FlashPix, and GIF images may lead to     an application crash or arbitrary code execution.     (CVE-2010-3788, CVE-2010-3794, CVE-2010-3795)

  - Memory corruption issues in QuickTime's handling of     AVI files, movie files, Sorenson encoded movie files,     PICT files, FlashPix images, and panorama atoms in QTVR     (QuickTime Virtual Reality) movie files may lead to an     application crash or arbitrary code execution.     (CVE-2010-3789, CVE-2010-3790, CVE-2010-3793,     CVE-2010-3800, CVE-2010-3801, CVE-2010-3802)

  - A buffer overflow in QuickTime's handling of MPEG-     encoded movie files may lead to an application crash or     arbitrary code execution. (CVE-2010-3791)

  - A signedness issue in QuickTime's handling of MPEG-     encoded movie files may lead to an application crash or     arbitrary code execution. (CVE-2010-3792)

  - An integer overflow in QuickTime's handling of movie     files may lead to an application crash or arbitrary     code execution. (CVE-2010-4009)

Versions of Mac OS X 10.6 earlier than 10.6.5 are potentially affected by multiple vulnerabilities.  Mac OS X 10.6.5 contains security fixes for the following products :

  - AFP Server

  - Apache mod_perl

  - Apache

  - AppKit

  - ATS

  - CFNetwork

  - CoreGraphics

  - CoreText

  - CUPS

  - Directory Services

  - diskdev_cmds

Disk Images

  - Flash Player plug-in

  - gzip

  - Image Capture

  - ImageIO

  - Image RAW

  - Kernel

  - MySQL

  - neon

  - Networking

  - OpenLDAP

  - OpenSSL

  - Password Server

  - PHP

  - Printing

  - python

  - QuickLook

  - QuickTime

  - Safari RSS

  - Time Machine

  - Wiki Server

  - X11

  - xar

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.5.

Mac OS X 10.6.5 contains security fixes for the following products :

  - AFP Server
  - Apache mod_perl
  - Apache
  - AppKit
  - ATS
  - CFNetwork
  - CoreGraphics
  - CoreText
  - CUPS
  - Directory Services
  - diskdev_cmds
  - Disk Images
  - Flash Player plug-in
  - gzip
  - Image Capture
  - ImageIO
  - Image RAW
  - Kernel
  - MySQL
  - neon
  - Networking
  - OpenLDAP
  - OpenSSL
  - Password Server
  - PHP
  - Printing
  - python
  - QuickLook
  - QuickTime
  - Safari RSS
  - Time Machine
  - Wiki Server
  - X11
  - xar

ID	Name	Product	Family	Severity
55416	Mac OS X 10.6.x < 10.6.8 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
800790	Mac OS X 10.6 < 10.6.8 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	high
5968	Mac OS X 10.6 < 10.6.8 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
801191	QuickTime < 7.6.9 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
5725	QuickTime < 7.6.9 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
51062	QuickTime < 7.6.9 Multiple Vulnerabilities (Windows)	Nessus	Windows	high
51061	QuickTime < 7.6.9 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
5705	Mac OS X 10.6 < 10.6.5 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
50548	Mac OS X 10.6.x < 10.6.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2010-3790

high

Tenable Plugins

critical

high

critical

high

medium

high

high

critical

critical