Detections
Analytics
QuickTime < 7.5.5 Multiple Vulnerabilities (Windows)
high Nessus Plugin ID 34119
Synopsis
The remote Windows host contains an application that is affected by multiple vulnerabilities.Description
The version of QuickTime installed on the remote Windows host is older than 7.5.5. Such versions contain several vulnerabilities :- An integer overflow in QuickTime's handling of PICT images may lead to an application crash or arbitrary code execution (CVE-2008-3614).
- An uninitialized memory access issue in the third- party Indeo v5 codec, which does not ship with QuickTime, may lead to an application crash or arbitrary code execution (CVE-2008-3615).
- Heap and stack-based buffer overflows in the handling of panorama atoms in QTVR (QuickTime Virtual Reality) movie files could lead to an application crash or arbitrary code execution (CVE-2008-3624 and CVE-2008-3625).
- A memory corruption issue in QuickTime's handling of STSZ atoms in movie files could lead to an application crash or arbitrary code execution (CVE-2008-3626).
- Multiple memory corruption issues in QuickTime's handling of H.264-encoded movie files could lead to an application crash or arbitrary code execution (CVE-2008-3627).
- An invalid pointer issue in QuickTime's handling of PICT images could lead to an application crash or arbitrary code execution (CVE-2008-3628).
- An out-of-bounds read issue in QuickTime's handling of PICT images could lead to an application crash (CVE-2008-3629).
- A stack-based buffer overflow exists in the third-party Indeo v3.2 codec for QuickTime, which could lead to an application crash or arbitrary code execution when viewing a specially crafted movie file (CVE-2008-3635).
Solution
Either use QuickTime's Software Update preference to upgrade to the latest version or manually upgrade to QuickTime 7.5.5 or later.See Also
http://support.apple.com/kb/HT3027
http://lists.apple.com/archives/security-announce/2008/Sep/msg00000.html
Plugin Details
Severity: High
ID: 34119
File Name: quicktime_755.nasl
Version: 1.15
Type: local
Agent: windows
Family: Windows
Published: 9/10/2008
Updated: 7/25/2018
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 6.9
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: cpe:/a:apple:quicktime
Required KB Items: SMB/QuickTime/Version
Exploit Ease: No known exploits are available
Reference Information
CVE: CVE-2008-3614, CVE-2008-3615, CVE-2008-3624, CVE-2008-3625, CVE-2008-3626, CVE-2008-3627, CVE-2008-3628, CVE-2008-3629, CVE-2008-3635