National Cyber-Alert System

Vulnerability Summary for CVE-2007-6166

Overview

Stack-based buffer overflow in Apple QuickTime before 7.3.1, as used in QuickTime Player on Windows XP and Safari on Mac OS X, allows remote Real Time Streaming Protocol (RTSP) servers to execute arbitrary code via an RTSP response with a long Content-Type header.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Technical Alert: TA07-334A

Name: TA07-334A

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA07-334A.html

US-CERT Vulnerability Note: VU#659761

Name: VU#659761

Hyperlink:http://www.kb.cert.org/vuls/id/659761

External Source: XF

Name: quicktime-rtsp-contenttype-bo(38604)

Hyperlink:http://xforce.iss.net/xforce/xfdb/38604

External Source: SECTRACK

Name: 1018989

Hyperlink:http://www.securitytracker.com/id?1018989

External Source: BID

Name: 26560

Hyperlink:http://www.securityfocus.com/bid/26560

External Source: BID

Name: 26549

Hyperlink:http://www.securityfocus.com/bid/26549

External Source: MILW0RM

Name: 6013

Hyperlink:http://www.milw0rm.com/exploits/6013

External Source: MILW0RM

Name: 4648

Hyperlink:http://www.milw0rm.com/exploits/4648

External Source: VUPEN

Name: ADV-2007-3984

Type: Advisory

Hyperlink:http://www.frsirt.com/english/advisories/2007/3984

External Source: MISC

Name: http://www.beskerming.com/security/2007/11/25/74/QuickTime_-_Remote_hacker_automatic_control

Hyperlink:http://www.beskerming.com/security/2007/11/25/74/QuickTime_-_Remote_hacker_automatic_control

External Source: SREASON

Name: 3410

Hyperlink:http://securityreason.com/securityalert/3410

External Source: GENTOO

Name: GLSA-200803-08

Hyperlink:http://security.gentoo.org/glsa/glsa-200803-08.xml

External Source: SECUNIA

Name: 29182

Type: Advisory

Hyperlink:http://secunia.com/advisories/29182

External Source: SECUNIA

Name: 27755

Type: Advisory

Hyperlink:http://secunia.com/advisories/27755

External Source: APPLE

Name: APPLE-SA-2007-12-13

Hyperlink:http://lists.apple.com/archives/Security-announce/2007/Dec/msg00000.html

External Source: MISC

Name: http://docs.info.apple.com/article.html?artnum=307176

Hyperlink:http://docs.info.apple.com/article.html?artnum=307176