Detections
Analytics
Quicktime Multiple Integer Overflows (deprecated)
high Nessus Network Monitor Plugin ID 2380
Synopsis
The remote host is vulnerable to a buffer overflow.Description
The remote host is running an older version of Quicktime player for Microsoft Windows. This version is vulnerable to a remote overflow. A remote attacker exploiting this flaw would need to create a malicious Quicktime file and entice the user to play it. A successful exploit would allow the attacker to execute random code within the context of the local machine. Additionally, there is a similar flaw within the Quicktime library that displays JPEG files. An attacker exploiting this second flaw would need to be able to convince a user into viewing a malicious JPEG file within the Quicktime viewer. Successful exploitation would result in arbitrary code being executed on the victim system.Solution
Upgrade or patch according to vendor recommendations.Plugin Details
Severity: High
ID: 2380
Family: Web Clients
Published: 11/2/2004
Updated: 3/6/2019
Nessus ID: 17637
Risk Information
VPR
Risk Factor: Medium
Score: 5.8
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: High
Base Score: 7.3
Temporal Score: 6.4
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:apple:quicktime