The quicktime_read_dref_table function in dref.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted mp4 file.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4545-1 advisory.

    It was discovered that libquicktime incorrectly handled certain malformed MP4 files. If a user were     tricked into opening a specially crafted MP4 file, a remote attacker could use this issue to cause a     denial of service (resource exhaustion). (CVE-2017-9122)

    It was discovered that libquicktime incorrectly handled certain malformed MP4 files. If a user were     tricked into opening a specially crafted MP4 file, a remote attacker could use this issue to cause     libquicktime to crash, resulting in a denial of service. (CVE-2017-9123, CVE-2017-9124, CVE-2017-9126,     CVE-2017-9127, CVE-2017-9128)

    It was discovered that libquicktime incorrectly handled certain malformed MP4 files. If a user were     tricked into opening a specially crafted MP4 file, a remote attacker could use this issue to cause a     denial of service. (CVE-2017-9125)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

CVE-2017-9122

The quicktime_read_moov function in moov.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted mp4 file.

CVE-2017-9123

The lqt_frame_duration function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted mp4 file.

CVE-2017-9124

The quicktime_match_32 function in util.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted mp4 file.

CVE-2017-9125

The lqt_frame_duration function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted mp4 file.

CVE-2017-9126

The quicktime_read_dref_table function in dref.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted mp4 file.

CVE-2017-9127

The quicktime_user_atoms_read_atom function in useratoms.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted mp4 file.

CVE-2017-9128

The quicktime_video_width function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted mp4 file.

For Debian 7 'Wheezy', these problems have been fixed in version 2:1.2.4-3+deb7u2.

We recommend that you upgrade your libquicktime packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libquicktime fixes the following issues :

  - CVE-2017-9122: A DoS in quicktime_read_moov function in     moov.c via acrafted mp4 file was fixed. (boo#1044077)

  - CVE-2017-9123: An invalid memory read in     lqt_frame_duration via a crafted mp4 file was fixed.
    (boo#1044009)

  - CVE-2017-9124: A NULL pointer dereference in     quicktime_match_32 via a crafted mp4 file was fixed.
    (boo#1044008)

  - CVE-2017-9125: A DoS in lqt_frame_duration function in     lqt_quicktime.c via crafted mp4 file was fixed.
    (boo#1044122)

  - CVE-2017-9126: A heap-based buffer overflow in     quicktime_read_dref_table via a crafted mp4 file was     fixed. (boo#1044006)

  - CVE-2017-9127: A heap-based buffer overflow in     quicktime_user_atoms_read_atom via a crafted mp4 file     was fixed. (boo#1044002)

  - CVE-2017-9128: A heap-based buffer over-read in     quicktime_video_width via a crafted mp4 file was fixed.
    (boo#1044000)

This update for libquicktime fixes the following issues :

  - CVE-2017-9122: A DoS in quicktime_read_moov function in     moov.c via acrafted mp4 file was fixed. (bsc#1044077)

  - CVE-2017-9123: An invalid memory read in     lqt_frame_duration via a crafted mp4 file was fixed.
    (bsc#1044009)

  - CVE-2017-9124: A NULL pointer dereference in     quicktime_match_32 via a crafted mp4 file was fixed.
    (bsc#1044008)

  - CVE-2017-9125: A DoS in lqt_frame_duration function in     lqt_quicktime.c via crafted mp4 file was fixed.
    (bsc#1044122)

  - CVE-2017-9126: A heap-based buffer overflow in     quicktime_read_dref_table via a crafted mp4 file was     fixed. (bsc#1044006)

  - CVE-2017-9127: A heap-based buffer overflow in     quicktime_user_atoms_read_atom via a crafted mp4 file     was fixed. (bsc#1044002)

  - CVE-2017-9128: A heap-based buffer over-read in     quicktime_video_width via a crafted mp4 file was fixed.
    (bsc#1044000)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
140800	Ubuntu 16.04 LTS : libquicktime vulnerabilities (USN-4545-1)	Nessus	Ubuntu Local Security Checks	medium
102040	Debian DLA-1042-1 : libquicktime security update	Nessus	Debian Local Security Checks	medium
101282	openSUSE Security Update : libquicktime (openSUSE-2017-785)	Nessus	SuSE Local Security Checks	medium
101223	SUSE SLED12 / SLES12 Security Update : libquicktime (SUSE-SU-2017:1769-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2017-9126

medium

Tenable Plugins

medium

medium

medium

medium