National Cyber Awareness System

Vulnerability Summary for CVE-2008-0234

Overview

Buffer overflow in Apple Quicktime Player 7.3.1.70 and other versions before 7.4.1, when RTSP tunneling is enabled, allows remote attackers to execute arbitrary code via a long Reason-Phrase response to an rtsp:// request, as demonstrated using a 404 error message.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Vulnerability Note: VU#112179

Name: VU#112179

Hyperlink:http://www.kb.cert.org/vuls/id/112179

External Source: APPLE

Name: APPLE-SA-2008-07-10

Type: Advisory; Patch Information

Hyperlink:http://lists.apple.com/archives/security-announce/2008//Jul/msg00000.html

External Source: XF

Name: quicktime-rtsp-responses-bo(39601)

Hyperlink:http://xforce.iss.net/xforce/xfdb/39601

External Source: VUPEN

Name: ADV-2008-2064

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2008/2064/references

External Source: VUPEN

Name: ADV-2008-0107

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2008/0107

External Source: SECTRACK

Name: 1019178

Hyperlink:http://www.securitytracker.com/id?1019178

External Source: BID

Name: 27225

Hyperlink:http://www.securityfocus.com/bid/27225

External Source: BUGTRAQ

Name: 20080112 Re: Buffer-overflow in Quicktime Player 7.3.1.70

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/486268/100/0/threaded

External Source: BUGTRAQ

Name: 20080112 Re: Re: Buffer-overflow in Quicktime Player 7.3.1.70

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/486241/100/0/threaded

External Source: BUGTRAQ

Name: 20080114 Re: [Full-disclosure] Buffer-overflow in Quicktime Player 7.3.1.70

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/486238/100/0/threaded

External Source: BUGTRAQ

Name: 20080111 Re: Buffer-overflow in Quicktime Player 7.3.1.70

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/486174/100/0/threaded

External Source: BUGTRAQ

Name: 20080111 Re: Re: Buffer-overflow in Quicktime Player 7.3.1.70

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/486161/100/0/threaded

External Source: BUGTRAQ

Name: 20080110 Re: Buffer-overflow in Quicktime Player 7.3.1.70

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/486114/100/0/threaded

External Source: BUGTRAQ

Name: 20080110 Buffer-overflow in Quicktime Player 7.3.1.70

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/486091/100/0/threaded

External Source: MILW0RM

Name: 4906

Hyperlink:http://www.milw0rm.com/exploits/4906

External Source: MILW0RM

Name: 4885

Hyperlink:http://www.milw0rm.com/exploits/4885

External Source: SREASON

Name: 3537

Hyperlink:http://securityreason.com/securityalert/3537

External Source: SECUNIA

Name: 31034

Type: Advisory

Hyperlink:http://secunia.com/advisories/31034

External Source: SECUNIA

Name: 28423

Type: Advisory

Hyperlink:http://secunia.com/advisories/28423

External Source: APPLE

Name: APPLE-SA-2008-02-06

Hyperlink:http://lists.apple.com/archives/security-announce/2008/Feb/msg00001.html