Info

Disclosure

Jan 11, 2006

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Unknown

Description

An overflow exists in QuickTime. QuickTime fails to validate certain boundaries and integer fields within TGA files, resulting in buffer overflows. With a specially crafted file, an attacker can cause arbitrary code execution, resulting in a loss of integrity.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Unknown
Disclosure: OSVDB Verified

Solution

Upgrade to version 7.0.4 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Apple Computer, Inc.

QuickTime

7.0.3

References

Security Tracker: 1015464
Bugtraq ID: 16202
Secunia Advisory ID: 18370
CVE ID: 2005-3707 (see also: NVD) 2005-3708 (see also: NVD) 2005-3709 (see also: NVD)
Related OSVDB ID: 22333 22334 22335 22337 22338
Mail List Post: http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0445.html
http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0447.html
Other Advisory URL: http://docs.info.apple.com/article.html?artnum=303101

Credit

Dejun Meng - Fortinet

Direct URL: http://osvdb.org/22336