| Vulnerability Name: | CVE-2006-4381 (CCN-28928) |
| Assigned: | 2006-09-12 |
| Published: | 2006-09-12 |
| Updated: | 2018-10-17 |
| Summary: | Integer overflow in Apple QuickTime before 7.1.3 allows user-assisted remote attackers to execute arbitrary code via a crafted H.264 movie.
This vulnerability is addressed in the following product release:
Apple, QuickTime Player, 7.1.3
|
| CVSS v3 Severity: | 5.6 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)| Exploitability Metrics: | Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None | | Scope: | Scope (S): Unchanged
| | Impact Metrics: | Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low |
|
| CVSS v2 Severity: | 5.1 Medium (CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P)
3.8 Low (Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): High
Authentication (Au): None | | Impact Metrics: | Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial |
5.1 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P)
3.8 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
| | Impact Metrics: | Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial |
|
| Vulnerability Type: | CWE-Other
|
| Vulnerability Consequences: | Gain Access |
| References: | Source: CCN
Type: Full-Disclosure Mailing List, Tue Sep 12 2006 - 14:51:24 CDT
Apple QuickTime H.264 Integer Overflow Vulnerability
Source: MITRE
Type: CNA
CVE-2006-4381
Source: CCN
Type: Apple QuickTime 7.1.3 Update
About the security content of QuickTime 7.1.3
Source: CONFIRM
Type: UNKNOWN
http://docs.info.apple.com/article.html?artnum=304357
Source: APPLE
Type: Patch
APPLE-SA-2006-09-12
Source: CCN
Type: SA21893
Apple QuickTime Multiple Vulnerabilities
Source: SECUNIA
Type: UNKNOWN
21893
Source: SREASON
Type: UNKNOWN
1551
Source: CCN
Type: SECTRACK ID: 1016830
QuickTime Overflows in Processing H.264, QuickTime, FLC, FlashPix and SGI Files Let Remote Users Execute Arbitrary Code
Source: SECTRACK
Type: UNKNOWN
1016830
Source: MISC
Type: Exploit, Patch, Vendor Advisory
http://secway.org/advisory/AD20060912.txt
Source: OSVDB
Type: UNKNOWN
28774
Source: CCN
Type: OSVDB ID: 28774
Apple QuickTime H.264 Movie Processing Overflow
Source: BUGTRAQ
Type: UNKNOWN
20060912 Apple QuickTime H.264 Integer Overflow Vulnerability
Source: BID
Type: Exploit, Patch
19976
Source: CCN
Type: BID-19976
Apple QuickTime Multiple Overflow and Exception Vulnerabilities
Source: CCN
Type: US-CERT Technical Cyber Security Alert TA06-256A
Technical Cyber Security Alert TA06-256A
Source: VUPEN
Type: UNKNOWN
ADV-2006-3577
Source: XF
Type: UNKNOWN
quicktime-h264-integer-overflow(28928)
Source: XF
Type: UNKNOWN
quicktime-h264-integer-overflow(28928)
|
| Vulnerable Configuration: | Configuration 1:
cpe:/a:apple:quicktime:5.0:*:*:*:*:*:*:*OR cpe:/a:apple:quicktime:5.0.1:*:*:*:*:*:*:*OR cpe:/a:apple:quicktime:5.0.2:*:*:*:*:*:*:*OR cpe:/a:apple:quicktime:6.0:*:*:*:*:*:*:*OR cpe:/a:apple:quicktime:6.1:*:*:*:*:*:*:*OR cpe:/a:apple:quicktime:6.5:*:*:*:*:*:*:*OR cpe:/a:apple:quicktime:6.5.1:*:*:*:*:*:*:*OR cpe:/a:apple:quicktime:6.5.2:*:*:*:*:*:*:*OR cpe:/a:apple:quicktime:6.5.2:*:mac_os_x_10.2:*:*:*:*:*OR cpe:/a:apple:quicktime:6.5.2:*:mac_os_x_10.3:*:*:*:*:*OR cpe:/a:apple:quicktime:7.0:*:*:*:*:*:*:*OR cpe:/a:apple:quicktime:7.0:*:windows:*:*:*:*:*OR cpe:/a:apple:quicktime:7.0.1:*:*:*:*:*:*:*OR cpe:/a:apple:quicktime:7.0.1:*:mac_os_x_10.3:*:*:*:*:*OR cpe:/a:apple:quicktime:7.0.1:*:mac_os_x_10.4:*:*:*:*:*OR cpe:/a:apple:quicktime:7.0.1:*:windows:*:*:*:*:*OR cpe:/a:apple:quicktime:7.0.2:*:*:*:*:*:*:*OR cpe:/a:apple:quicktime:7.0.2:*:windows:*:*:*:*:*OR cpe:/a:apple:quicktime:7.0.3:*:*:*:*:*:*:*OR cpe:/a:apple:quicktime:7.0.4:*:*:*:*:*:*:*OR cpe:/a:apple:quicktime:7.1.1:*:*:*:*:*:*:*OR cpe:/a:apple:quicktime:*:*:*:*:*:*:*:* (Version <= 7.1.2)
Configuration CCN 1:
cpe:/a:apple:quicktime:7.0.1:*:*:*:*:*:*:*OR cpe:/a:apple:quicktime:7.0.3:*:*:*:*:*:*:*OR cpe:/a:apple:quicktime:7.0:*:*:*:*:*:*:*OR cpe:/a:apple:quicktime:7.0.2:*:*:*:*:*:*:*OR cpe:/a:apple:quicktime:7.0.4:*:*:*:*:*:*:*OR cpe:/a:apple:quicktime:7.1:*:*:*:*:*:*:*OR cpe:/a:apple:quicktime:7.1.1:*:*:*:*:*:*:*OR cpe:/a:apple:quicktime:7.1.2:*:*:*:*:*:*:*
 Denotes that component is vulnerable |
| BACK |