cbcvebase.
CVE-2012-3752
published 2012-11-09

CVE-2012-3752: Multiple buffer overflows in Apple QuickTime before 7.7.3 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via…

PriorityP259critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
36.01%
98.3th percentile
Multiple buffer overflows in Apple QuickTime before 7.7.3 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted style element in a QuickTime TeXML file.

Affected

51 ranges· showing 25
VendorProductVersion rangeFixed in
applequicktime<= 7.7.2
applequicktime
applequicktime
applequicktime
applequicktime
applequicktime
applequicktime
applequicktime
applequicktime
applequicktime
applequicktime
applequicktime
applequicktime
applequicktime
applequicktime
applequicktime
applequicktime
applequicktime
applequicktime
applequicktime
applequicktime
applequicktime
applequicktime
applequicktime
applequicktime

Detection & IOCsextracted from sources · hover to see the quote

filenameQuickTime3GPP.gtx
otherContent-Type: application/x-quicktime-texml
  • Detect delivery of crafted QuickTime TeXML files via HTTP response Content-Type header 'application/x-quicktime-texml', especially when the file contains an oversized font-table style field (e.g., 16KB of repeated '1' characters).
  • Look for TeXML files (.3gp extension served with TeXML content) containing a font-table style field with a large payload composed exclusively of bytes 0x31–0x39 ('1'–'9'), indicative of the constrained overflow.
  • Monitor QuickTime processes for suspicious child process creation or migration activity, as the Metasploit module uses 'migrate -f' as InitialAutoRunScript after exploitation.
  • The vulnerable component is QuickTime3GPP.gtx; alert on stack-based buffer overflow indicators (e.g., SEH overwrites, abnormal stack frames) within this DLL when processing style element subfields.
  • The overflow check routine only allows digit characters (0x31–0x39); any font-table, font-size, or line-height field in a TeXML style block containing a long run of digit-only bytes should be treated as suspicious.
  • ·The Metasploit module targets only IE 6/7 and Firefox 3.5/3.5.1 on Windows XP/Vista; exploitation against other browsers or OS versions is not supported by this module and will return a 404.
  • ·DEP/ASLR bypass is not implemented in this exploit due to the byte restriction (only 0x31–0x39 usable), limiting reliable exploitation to systems without these mitigations.
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.