VAR-200801-0212
Vulnerability from variot - Updated: 2023-12-18 12:12Buffer overflow in Apple Quicktime Player 7.3.1.70 and other versions before 7.4.1, when RTSP tunneling is enabled, allows remote attackers to execute arbitrary code via a long Reason-Phrase response to an rtsp:// request, as demonstrated using a 404 error message. Winodws Plate and Mac Edition QuickTime Are affected by this vulnerability. Also, iTunes Such QuickTime Systems that have installed software that uses Microsoft are also affected by this vulnerability. In addition, verification code that exploits this vulnerability has already been published. 2008/01/16 Apple Is Quicktime 7.4 Was released, but after confirming it based on the verification code for this case, Quicktime 7.3 The same phenomenon as the access violation that occurred in was confirmed. Care must be taken until a formal measure is released on this matter.Various web page content and Quicktime Crafted by a remote third party through a media link file RTSP stream Arbitrary code execution or denial of service due to user connection to (DoS) You can be attacked. Attackers can leverage this issue to execute arbitrary machine code in the context of the user running the affected application. Successful exploits will compromise the application and possibly the underlying computer. Failed attacks will likely cause denial-of-service conditions. NOTE: Additional information from the reporter indicates this issue affects QuickTime running on the following platforms: Microsoft Windows XP, Windows Vista, and Apple Mac OS X. Apple QuickTime is a multimedia playback software developed by Apple (Apple). The software is capable of handling multiple sources such as digital video, media segments, and more. If the user follows the rtsp:// connection and the server's port 554 is closed, Quicktime will automatically change the transmission method and try the HTTP protocol on port 80, and the LCD type screen will display the server's 404 error message. ----------------------------------------------------------------------
Want a new job?
http://secunia.com/secunia_security_specialist/ http://secunia.com/hardcore_disassembler_and_reverse_engineer/
International Partner Manager - Project Sales in the IT-Security Industry: http://corporate.secunia.com/about_secunia/64/
TITLE: Apple TV Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA31034
VERIFY ADVISORY: http://secunia.com/advisories/31034/
CRITICAL: Highly critical
IMPACT: System access
WHERE:
From remote
OPERATING SYSTEM: Apple TV 2.x http://secunia.com/product/19289/
DESCRIPTION: Some vulnerabilities have been reported in Apple TV, which can be exploited by malicious people to compromise a vulnerable system.
1) A boundary error in the handling of data reference atoms in movie files can be exploited to cause a buffer overflow.
For more information see vulnerability #3 in: SA29650
2) A boundary error in the handling of "crgn" atoms in movie files can be exploited to cause a heap-based buffer overflow.
For more information see vulnerability #5 in: SA29650
3) A boundary error in the handling of "chan" atoms in movie files can be exploited to cause a heap-based buffer overflow.
For more information see vulnerability #6 in: SA29650
4) An error in the handling of "file:" URLs can be exploited to e.g. execute arbitrary programs.
For more information: SA28423
6) A boundary error when processing compressed PICT images can be exploited to cause a buffer overflow.
For more information see vulnerability #4 in: SA28502
SOLUTION: Update to version 2.1.
PROVIDED AND/OR DISCOVERED BY: 1,6) Chris Ries of Carnegie Mellon University Computing Services. 2) Sanbin Li, reporting via ZDI. 3) An anonymous researcher, reporting via ZDI. 4) Independently discovered by: * Vinoo Thomas and Rahul Mohandas, McAfee Avert Labs * Petko D. (pdp) Petkov, GNUCITIZEN 5) Luigi Auriemma
ORIGINAL ADVISORY: http://support.apple.com/kb/HT2304
OTHER REFERENCES: SA28423: http://secunia.com/advisories/28423/
SA28502: http://secunia.com/advisories/28502/
SA29293: http://secunia.com/advisories/29293/
SA29650: http://secunia.com/advisories/29650/
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
.
A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched. sending a specially crafted reply containing an overly-long "Reason-Phrase".
Successful exploitation may allow execution of arbitrary code, but requires that the user is e.g. tricked into opening a malicious QTL file or visiting a malicious web site.
SOLUTION: Do not browse untrusted websites, open malicious .QTL files, or follow untrusted links
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200801-0212",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "quicktime",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "7.4"
},
{
"model": "quicktime",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "7.3.1.70"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "apple computer",
"version": null
},
{
"model": "tv",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "2.1"
},
{
"model": "quicktime",
"scope": "lte",
"trust": 0.8,
"vendor": "apple",
"version": "4.0 from 7.4"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.0"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.3.1.70"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.3.1"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.1.6"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.1.5"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.1.4"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.1.3"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.1.2"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.1.1"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.4"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.3"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.2"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.1"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.4"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.3"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.2"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.1"
},
{
"model": "tv",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "2.1"
},
{
"model": "quicktime player",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "7.4.1"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#112179"
},
{
"db": "BID",
"id": "27225"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001017"
},
{
"db": "NVD",
"id": "CVE-2008-0234"
},
{
"db": "CNNVD",
"id": "CNNVD-200801-182"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:apple:quicktime:7.3.1.70:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apple:quicktime:7.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2008-0234"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Luigi Auriemma aluigi@pivx.com",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200801-182"
}
],
"trust": 0.6
},
"cve": "CVE-2008-0234",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 6.8,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2008-0234",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-30359",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2008-0234",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#112179",
"trust": 0.8,
"value": "13.47"
},
{
"author": "NVD",
"id": "CVE-2008-0234",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-200801-182",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-30359",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#112179"
},
{
"db": "VULHUB",
"id": "VHN-30359"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001017"
},
{
"db": "NVD",
"id": "CVE-2008-0234"
},
{
"db": "CNNVD",
"id": "CNNVD-200801-182"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Buffer overflow in Apple Quicktime Player 7.3.1.70 and other versions before 7.4.1, when RTSP tunneling is enabled, allows remote attackers to execute arbitrary code via a long Reason-Phrase response to an rtsp:// request, as demonstrated using a 404 error message. Winodws Plate and Mac Edition QuickTime Are affected by this vulnerability. Also, iTunes Such QuickTime Systems that have installed software that uses Microsoft are also affected by this vulnerability. In addition, verification code that exploits this vulnerability has already been published. 2008/01/16 Apple Is Quicktime 7.4 Was released, but after confirming it based on the verification code for this case, Quicktime 7.3 The same phenomenon as the access violation that occurred in was confirmed. Care must be taken until a formal measure is released on this matter.Various web page content and Quicktime Crafted by a remote third party through a media link file RTSP stream Arbitrary code execution or denial of service due to user connection to (DoS) You can be attacked. \nAttackers can leverage this issue to execute arbitrary machine code in the context of the user running the affected application. Successful exploits will compromise the application and possibly the underlying computer. Failed attacks will likely cause denial-of-service conditions. \nNOTE: Additional information from the reporter indicates this issue affects QuickTime running on the following platforms: Microsoft Windows XP, Windows Vista, and Apple Mac OS X. Apple QuickTime is a multimedia playback software developed by Apple (Apple). The software is capable of handling multiple sources such as digital video, media segments, and more. If the user follows the rtsp:// connection and the server\u0027s port 554 is closed, Quicktime will automatically change the transmission method and try the HTTP protocol on port 80, and the LCD type screen will display the server\u0027s 404 error message. ----------------------------------------------------------------------\n\nWant a new job?\n\nhttp://secunia.com/secunia_security_specialist/\nhttp://secunia.com/hardcore_disassembler_and_reverse_engineer/\n\nInternational Partner Manager - Project Sales in the IT-Security\nIndustry:\nhttp://corporate.secunia.com/about_secunia/64/\n\n----------------------------------------------------------------------\n\nTITLE:\nApple TV Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA31034\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/31034/\n\nCRITICAL:\nHighly critical\n\nIMPACT:\nSystem access\n\nWHERE:\n\u003eFrom remote\n\nOPERATING SYSTEM:\nApple TV 2.x\nhttp://secunia.com/product/19289/\n\nDESCRIPTION:\nSome vulnerabilities have been reported in Apple TV, which can be\nexploited by malicious people to compromise a vulnerable system. \n\n1) A boundary error in the handling of data reference atoms in movie\nfiles can be exploited to cause a buffer overflow. \n\nFor more information see vulnerability #3 in:\nSA29650\n\n2) A boundary error in the handling of \"crgn\" atoms in movie files\ncan be exploited to cause a heap-based buffer overflow. \n\nFor more information see vulnerability #5 in:\nSA29650\n\n3) A boundary error in the handling of \"chan\" atoms in movie files\ncan be exploited to cause a heap-based buffer overflow. \n\nFor more information see vulnerability #6 in:\nSA29650\n\n4) An error in the handling of \"file:\" URLs can be exploited to e.g. \nexecute arbitrary programs. \n\nFor more information:\nSA28423\n\n6) A boundary error when processing compressed PICT images can be\nexploited to cause a buffer overflow. \n\nFor more information see vulnerability #4 in:\nSA28502\n\nSOLUTION:\nUpdate to version 2.1. \n\nPROVIDED AND/OR DISCOVERED BY:\n1,6) Chris Ries of Carnegie Mellon University Computing Services. \n2) Sanbin Li, reporting via ZDI. \n3) An anonymous researcher, reporting via ZDI. \n4) Independently discovered by:\n* Vinoo Thomas and Rahul Mohandas, McAfee Avert Labs\n* Petko D. (pdp) Petkov, GNUCITIZEN\n5) Luigi Auriemma\n\nORIGINAL ADVISORY:\nhttp://support.apple.com/kb/HT2304\n\nOTHER REFERENCES:\nSA28423:\nhttp://secunia.com/advisories/28423/\n\nSA28502:\nhttp://secunia.com/advisories/28502/\n\nSA29293:\nhttp://secunia.com/advisories/29293/\n\nSA29650:\nhttp://secunia.com/advisories/29650/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. \n\n----------------------------------------------------------------------\n\nA new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI\nhas been released. The new version includes many new and advanced\nfeatures, which makes it even easier to stay patched. \nsending a specially crafted reply containing an overly-long\n\"Reason-Phrase\". \n\nSuccessful exploitation may allow execution of arbitrary code, but\nrequires that the user is e.g. tricked into opening a malicious QTL\nfile or visiting a malicious web site. \n\nSOLUTION:\nDo not browse untrusted websites, open malicious .QTL files, or\nfollow untrusted links",
"sources": [
{
"db": "NVD",
"id": "CVE-2008-0234"
},
{
"db": "CERT/CC",
"id": "VU#112179"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001017"
},
{
"db": "BID",
"id": "27225"
},
{
"db": "VULHUB",
"id": "VHN-30359"
},
{
"db": "PACKETSTORM",
"id": "68131"
},
{
"db": "PACKETSTORM",
"id": "62662"
}
],
"trust": 2.88
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-30359",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-30359"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#112179",
"trust": 3.7
},
{
"db": "SECUNIA",
"id": "28423",
"trust": 3.5
},
{
"db": "BID",
"id": "27225",
"trust": 2.8
},
{
"db": "NVD",
"id": "CVE-2008-0234",
"trust": 2.8
},
{
"db": "EXPLOIT-DB",
"id": "4906",
"trust": 2.5
},
{
"db": "EXPLOIT-DB",
"id": "4885",
"trust": 2.5
},
{
"db": "SECTRACK",
"id": "1019178",
"trust": 2.5
},
{
"db": "SECUNIA",
"id": "31034",
"trust": 1.8
},
{
"db": "VUPEN",
"id": "ADV-2008-2064",
"trust": 1.7
},
{
"db": "VUPEN",
"id": "ADV-2008-0107",
"trust": 1.7
},
{
"db": "SREASON",
"id": "3537",
"trust": 1.7
},
{
"db": "XF",
"id": "39601",
"trust": 1.4
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001017",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-200801-182",
"trust": 0.7
},
{
"db": "MILW0RM",
"id": "4885",
"trust": 0.6
},
{
"db": "MILW0RM",
"id": "4906",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20080111 RE: RE: BUFFER-OVERFLOW IN QUICKTIME PLAYER 7.3.1.70",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20080110 RE: BUFFER-OVERFLOW IN QUICKTIME PLAYER 7.3.1.70",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20080114 RE: [FULL-DISCLOSURE] BUFFER-OVERFLOW IN QUICKTIME PLAYER 7.3.1.70",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20080112 RE: BUFFER-OVERFLOW IN QUICKTIME PLAYER 7.3.1.70",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20080112 RE: RE: BUFFER-OVERFLOW IN QUICKTIME PLAYER 7.3.1.70",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20080110 BUFFER-OVERFLOW IN QUICKTIME PLAYER 7.3.1.70",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20080111 RE: BUFFER-OVERFLOW IN QUICKTIME PLAYER 7.3.1.70",
"trust": 0.6
},
{
"db": "APPLE",
"id": "APPLE-SA-2008-07-10",
"trust": 0.6
},
{
"db": "APPLE",
"id": "APPLE-SA-2008-02-06",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "11373",
"trust": 0.6
},
{
"db": "SEEBUG",
"id": "SSVID-65116",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-30359",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "68131",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "62662",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#112179"
},
{
"db": "VULHUB",
"id": "VHN-30359"
},
{
"db": "BID",
"id": "27225"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001017"
},
{
"db": "PACKETSTORM",
"id": "68131"
},
{
"db": "PACKETSTORM",
"id": "62662"
},
{
"db": "NVD",
"id": "CVE-2008-0234"
},
{
"db": "CNNVD",
"id": "CNNVD-200801-182"
}
]
},
"id": "VAR-200801-0212",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-30359"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:12:12.743000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "QuickTime - \u30c0\u30a6\u30f3\u30ed\u30fc\u30c9",
"trust": 0.8,
"url": "http://www.apple.com/jp/quicktime/download/"
},
{
"title": "QuickTime 7.4.1",
"trust": 0.8,
"url": "http://docs.info.apple.com/article.html?artnum=307407-en"
},
{
"title": "Apple TV 2.1",
"trust": 0.8,
"url": "http://support.apple.com/kb/ht2304"
},
{
"title": "Apple TV 2.1",
"trust": 0.8,
"url": "http://support.apple.com/kb/ht2304?locale=ja_jp"
},
{
"title": "QuickTime 7.4.1",
"trust": 0.8,
"url": "http://docs.info.apple.com/article.html?artnum=307407"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-001017"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-30359"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001017"
},
{
"db": "NVD",
"id": "CVE-2008-0234"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.9,
"url": "http://www.kb.cert.org/vuls/id/112179"
},
{
"trust": 2.5,
"url": "http://www.securityfocus.com/bid/27225"
},
{
"trust": 1.8,
"url": "http://secunia.com/advisories/28423/"
},
{
"trust": 1.7,
"url": "http://lists.apple.com/archives/security-announce/2008/feb/msg00001.html"
},
{
"trust": 1.7,
"url": "http://lists.apple.com/archives/security-announce/2008//jul/msg00000.html"
},
{
"trust": 1.7,
"url": "http://www.securitytracker.com/id?1019178"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/28423"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/31034"
},
{
"trust": 1.7,
"url": "http://securityreason.com/securityalert/3537"
},
{
"trust": 1.4,
"url": "http://www.milw0rm.com/exploits/4885"
},
{
"trust": 1.4,
"url": "http://www.milw0rm.com/exploits/4906"
},
{
"trust": 1.4,
"url": "http://www.frsirt.com/english/advisories/2008/0107"
},
{
"trust": 1.4,
"url": "http://xforce.iss.net/xforce/xfdb/39601"
},
{
"trust": 1.1,
"url": "http://docs.info.apple.com/article.html?artnum=307407"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/486091/100/0/threaded"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/486114/100/0/threaded"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/486174/100/0/threaded"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/486161/100/0/threaded"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/486268/100/0/threaded"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/486241/100/0/threaded"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/486238/100/0/threaded"
},
{
"trust": 1.1,
"url": "https://www.exploit-db.com/exploits/4885"
},
{
"trust": 1.1,
"url": "https://www.exploit-db.com/exploits/4906"
},
{
"trust": 1.1,
"url": "http://www.vupen.com/english/advisories/2008/0107"
},
{
"trust": 1.1,
"url": "http://www.vupen.com/english/advisories/2008/2064/references"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39601"
},
{
"trust": 0.8,
"url": "http://tools.ietf.org/html/rfc2326"
},
{
"trust": 0.8,
"url": "http://noscript.net/features#contentblocking"
},
{
"trust": 0.8,
"url": "http://www.us-cert.gov/reading_room/securing_browser/"
},
{
"trust": 0.8,
"url": "http://plugindoc.mozdev.org/faqs/uninstall.html"
},
{
"trust": 0.8,
"url": "http://support.microsoft.com/kb/240797"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-0234"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnvu%23112179/index.html"
},
{
"trust": 0.8,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2008-0234"
},
{
"trust": 0.8,
"url": "http://securitytracker.com/id?1019178"
},
{
"trust": 0.8,
"url": "http://www.cyberpolice.go.jp/important/2008/20080207_164356.html"
},
{
"trust": 0.6,
"url": "http://www.frsirt.com/english/advisories/2008/2064/references"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/486268/100/0/threaded"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/486241/100/0/threaded"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/486238/100/0/threaded"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/486174/100/0/threaded"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/486161/100/0/threaded"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/486114/100/0/threaded"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/486091/100/0/threaded"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/11373"
},
{
"trust": 0.3,
"url": "http://www.apple.com/quicktime/"
},
{
"trust": 0.3,
"url": "/archive/1/486091"
},
{
"trust": 0.3,
"url": "/archive/1/486238"
},
{
"trust": 0.3,
"url": "/archive/1/486186"
},
{
"trust": 0.3,
"url": "/archive/1/486114"
},
{
"trust": 0.2,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.2,
"url": "http://secunia.com/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/31034/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/28502/"
},
{
"trust": 0.1,
"url": "http://secunia.com/hardcore_disassembler_and_reverse_engineer/"
},
{
"trust": 0.1,
"url": "http://support.apple.com/kb/ht2304"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/19289/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/29293/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_specialist/"
},
{
"trust": 0.1,
"url": "http://corporate.secunia.com/about_secunia/64/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/29650/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/5090/"
},
{
"trust": 0.1,
"url": "https://psi.secunia.com/?page=changelog"
},
{
"trust": 0.1,
"url": "https://psi.secunia.com/"
},
{
"trust": 0.1,
"url": "http://aluigi.altervista.org/adv/quicktimebof-adv.txt"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#112179"
},
{
"db": "VULHUB",
"id": "VHN-30359"
},
{
"db": "BID",
"id": "27225"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001017"
},
{
"db": "PACKETSTORM",
"id": "68131"
},
{
"db": "PACKETSTORM",
"id": "62662"
},
{
"db": "NVD",
"id": "CVE-2008-0234"
},
{
"db": "CNNVD",
"id": "CNNVD-200801-182"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#112179"
},
{
"db": "VULHUB",
"id": "VHN-30359"
},
{
"db": "BID",
"id": "27225"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001017"
},
{
"db": "PACKETSTORM",
"id": "68131"
},
{
"db": "PACKETSTORM",
"id": "62662"
},
{
"db": "NVD",
"id": "CVE-2008-0234"
},
{
"db": "CNNVD",
"id": "CNNVD-200801-182"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2008-01-10T00:00:00",
"db": "CERT/CC",
"id": "VU#112179"
},
{
"date": "2008-01-11T00:00:00",
"db": "VULHUB",
"id": "VHN-30359"
},
{
"date": "2008-01-10T00:00:00",
"db": "BID",
"id": "27225"
},
{
"date": "2008-01-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-001017"
},
{
"date": "2008-07-11T22:41:13",
"db": "PACKETSTORM",
"id": "68131"
},
{
"date": "2008-01-16T05:28:37",
"db": "PACKETSTORM",
"id": "62662"
},
{
"date": "2008-01-11T02:46:00",
"db": "NVD",
"id": "CVE-2008-0234"
},
{
"date": "2008-01-11T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200801-182"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2008-02-07T00:00:00",
"db": "CERT/CC",
"id": "VU#112179"
},
{
"date": "2018-10-15T00:00:00",
"db": "VULHUB",
"id": "VHN-30359"
},
{
"date": "2008-07-10T19:19:00",
"db": "BID",
"id": "27225"
},
{
"date": "2008-07-28T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-001017"
},
{
"date": "2018-10-15T21:58:45.563000",
"db": "NVD",
"id": "CVE-2008-0234"
},
{
"date": "2009-02-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200801-182"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200801-182"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apple QuickTime RTSP Response message Reason-Phrase buffer overflow vulnerability",
"sources": [
{
"db": "CERT/CC",
"id": "VU#112179"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200801-182"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…