CVE-2002-0252
published 2002-05-29CVE-2002-0252: Buffer overflow in Apple QuickTime Player 5.01 and 5.02 allows remote web servers to execute arbitrary code via a response containing a long Content-Type MIME…
PriorityP433high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
10.54%
95.3th percentile
Buffer overflow in Apple QuickTime Player 5.01 and 5.02 allows remote web servers to execute arbitrary code via a response containing a long Content-Type MIME header.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | quicktime | — | — |
| apple | quicktime | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Apple QuickTime 7.2/7.3 (OSX/Windows) - RSTP Response Universal
exploitdb·2007-11-29·CVSS 7.5
CVE-2002-0252 [HIGH] Apple QuickTime 7.2/7.3 (OSX/Windows) - RSTP Response Universal
Apple QuickTime 7.2/7.3 (OSX/Windows) - RSTP Response Universal
---
# Copyright (C) 2007 Subreption LLC. All rights reserved.
# Visit http://blog.subreption.com for exploit development notes.
#
# References:
# http://www.milw0rm.com/exploits/4648 (original Microsoft Windows code)
# http://www.milw0rm.com/exploits/4651 (recent Microsoft Windows exploit)
# From Metasploit: apple_quicktime_rtsp_response.rb (by MC and HD Moore)
# http://nvd.nist.gov/nvd.cfm?cvename=CVE-2002-0252
# BID: https://www.securityfocus.com/bid/26549
#
# Notes:
# Payload badchars: \x00 \x09 \x0a \x0d \x20 \x22 \x25 \x26 \x27 \x2b \x2f
# \x3a \x3c \x3e \x3f \x40
#
# The example addresses and data will trigger an IDS signature easily.
# Remove them if you're not testing, and change padding sizes accordingly.
# Use the
Exploit-DB
Apple QuickTime 5.0 - Content-Type Remote Buffer Overflow
exploitdb·2002-02-08
CVE-2002-0252 Apple QuickTime 5.0 - Content-Type Remote Buffer Overflow
Apple QuickTime 5.0 - Content-Type Remote Buffer Overflow
---
// source: https://www.securityfocus.com/bid/4064/info
Apple QuickTime is a freely available media player. It runs on a number of platforms including MacOS and Windows 9x/ME/NT/2000/XP operating systems.
Apple QuickTime For Windows does not perform sufficient bounds checking of the "Content-Type" header. This issue may be exploited if a server responds with a maliciously crafted "Content-Type" header to a HTTP request for a media file. A "Content-Type" header of 500+ characters is sufficient to trigger this condition, causing stack variables to be overwritten in the process.
This issue may allow a malicious server to execute arbitrary attacker-supplied code on the host of a client who makes a request for a media file. This
No writeups or analysis indexed.
http://marc.info/?l=bugtraq&m=101320742616105&w=2http://www.iss.net/security_center/static/8126.phphttp://www.securityfocus.com/bid/4064https://www.exploit-db.com/exploits/4673http://marc.info/?l=bugtraq&m=101320742616105&w=2http://www.iss.net/security_center/static/8126.phphttp://www.securityfocus.com/bid/4064https://www.exploit-db.com/exploits/4673
2002-05-29
Published