Quicktime < 7.0.1 Web Plugin Information Disclosure

low Nessus Network Monitor Plugin ID 2899

Synopsis

The remote host may give an attacker information useful for future attacks.

Description

The remote host is running an older version of Quicktime player for Microsoft Windows. This version is vulnerable to a remote information disclosure flaw. It is alleged that when the Quicktime web plugin parses a malformed '.mov' video file, information may be disclosed to the website that is hosting the movie file. The information which is disclosed may include the computer name, operating system version, and hardware specifics. Such information may be used by the attacker to launch a more sophisticated attack. A remote attacker exploiting this flaw would need to create a malicious '.mov' file and entice the user to play it.

Solution

Upgrade to version 7.0.1 or higher.

Plugin Details

Severity: Low

ID: 2899

Family: Web Clients

Published: 5/12/2005

Updated: 3/6/2019

Nessus ID: 18521

Risk Information

VPR

Risk Factor: Low

Score: 3.4

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.6

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS v3

Risk Factor: Low

Base Score: 3.7

Temporal Score: 3.5

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:apple:quicktime

Reference Information

CVE: CVE-2005-1579

BID: 13603

Detections

Analytics