Technical Description

Multiple vulnerabilities have been identified in Apple QuickTime, which could be exploited by remote attackers to take complete control of an affected system.

The first issue is caused by an uninitialized memory access in the third-party Indeo v5 codec (not shipped with QuickTime), which could be exploited to execute arbitrary code via a specially crafted movie file.

The second vulnerability is caused by a stack overflow error in the third-party Indeo v3.2 codec, which could be exploited to execute arbitrary code via a specially crafted movie file.

The third issue is caused by a heap overflow error when handling panorama atoms in QTVR (QuickTime Virtual Reality) movie files, which could be exploited by attackers to execute arbitrary code.

The fourth vulnerability is caused by a stack overflow error when handling panorama atoms in QTVR (QuickTime Virtual Reality) movie files, which could be exploited by attackers to execute arbitrary code.

The fifth issue is caused by an integer overflow error when handling malformed PICT images, which could allow attackers to compromise a vulnerable system via a malicious image.

The sixth vulnerability is caused by a memory corruption error when handling STSZ atoms in movie files, which could allow attackers to compromise a vulnerable system via a malicious movie file.

The seventh issue is caused by memory corruption errors when handling H.264 encoded movie files, which could be exploited by attackers to execute arbitrary code.

The eighth vulnerability is caused by an invalid pointer error when handling PICT images, which could be exploited by attackers to execute arbitrary code.

The ninth issue is caused by an out-of-bounds read error when handling PICT images, which could be exploited to cause a denial of service.

Credits

Vulnerabilities reported by Paul Byrne (NGSSoftware), Zero Day Initiative, Roee Hay (IBM Rational Application Security Research Group), iDefense Labs, Subreption LLC, David Wharton and Sergio shadown Alvarez (n.runs AG).

ChangeLog

2008-09-10 : Initial release

Vulnerability Management

Subscribe to VUPEN Security VNS and receive real-time e-mail and SMS alerts when new vulnerabilities, exploits, or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form or by email to updates@vupen.com.