Vulnerability Name:

CVE-2006-4382 (CCN-28929)

Assigned:2006-09-12
Published:2006-09-12
Updated:2018-10-17
Summary:Multiple buffer overflows in Apple QuickTime before 7.1.3 allow user-assisted remote attackers to execute arbitrary code via a crafted QuickTime movie.
This vulnerability is addressed in the following product release:
Apple, QuickTime Player, 7.1.3
CVSS v3 Severity:5.6 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:5.1 Medium (CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P)
3.8 Low (Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
5.1 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P)
3.8 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Access
References:Source: CCN
Type: Full-Disclosure Mailing List, Wed Sep 13 2006 - 11:56:06 CDT
Multiple Vulnerabilities in Apple QuickTime

Source: MITRE
Type: CNA
CVE-2006-4382

Source: CCN
Type: Apple QuickTime 7.1.3 Update
About the security content of QuickTime 7.1.3

Source: CONFIRM
Type: UNKNOWN
http://docs.info.apple.com/article.html?artnum=304357

Source: APPLE
Type: Patch
APPLE-SA-2006-09-12

Source: CCN
Type: SA21893
Apple QuickTime Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
21893

Source: SECUNIA
Type: UNKNOWN
29182

Source: GENTOO
Type: UNKNOWN
GLSA-200803-08

Source: SREASON
Type: UNKNOWN
1554

Source: CCN
Type: SECTRACK ID: 1016830
QuickTime Overflows in Processing H.264, QuickTime, FLC, FlashPix and SGI Files Let Remote Users Execute Arbitrary Code

Source: SECTRACK
Type: UNKNOWN
1016830

Source: CCN
Type: GLSA-200803-08
Win32 binary codecs: Multiple vulnerabilities

Source: CCN
Type: US-CERT VU#683700
Apple QuickTime movie buffer overflow vulnerability

Source: CERT-VN
Type: US Government Resource
VU#683700

Source: OSVDB
Type: UNKNOWN
28772

Source: CCN
Type: OSVDB ID: 28772
Apple QuickTime QT Movie Multiple Overflow

Source: BUGTRAQ
Type: UNKNOWN
20060913 Multiple Vulnerabilities in Apple QuickTime

Source: BID
Type: Patch
19976

Source: CCN
Type: BID-19976
Apple QuickTime Multiple Overflow and Exception Vulnerabilities

Source: CCN
Type: US-CERT Technical Cyber Security Alert TA06-256A
Technical Cyber Security Alert TA06-256A

Source: CERT
Type: US Government Resource
TA06-256A

Source: VUPEN
Type: UNKNOWN
ADV-2006-3577

Source: XF
Type: UNKNOWN
quicktime-movie-bo(28929)

Source: XF
Type: UNKNOWN
quicktime-movie-bo(28929)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:apple:quicktime:5.0:*:*:*:*:*:*:*
  • OR cpe:/a:apple:quicktime:5.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:apple:quicktime:5.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:apple:quicktime:6.0:*:*:*:*:*:*:*
  • OR cpe:/a:apple:quicktime:6.1:*:*:*:*:*:*:*
  • OR cpe:/a:apple:quicktime:6.5:*:*:*:*:*:*:*
  • OR cpe:/a:apple:quicktime:6.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:apple:quicktime:6.5.2:*:*:*:*:*:*:*
  • OR cpe:/a:apple:quicktime:6.5.2:*:mac_os_x_10.2:*:*:*:*:*
  • OR cpe:/a:apple:quicktime:6.5.2:*:mac_os_x_10.3:*:*:*:*:*
  • OR cpe:/a:apple:quicktime:7.0:*:*:*:*:*:*:*
  • OR cpe:/a:apple:quicktime:7.0:*:windows:*:*:*:*:*
  • OR cpe:/a:apple:quicktime:7.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:apple:quicktime:7.0.1:*:mac_os_x_10.3:*:*:*:*:*
  • OR cpe:/a:apple:quicktime:7.0.1:*:mac_os_x_10.4:*:*:*:*:*
  • OR cpe:/a:apple:quicktime:7.0.1:*:windows:*:*:*:*:*
  • OR cpe:/a:apple:quicktime:7.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:apple:quicktime:7.0.2:*:windows:*:*:*:*:*
  • OR cpe:/a:apple:quicktime:7.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:apple:quicktime:7.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:apple:quicktime:7.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:apple:quicktime:7.1.2:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:apple:quicktime:7.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:apple:quicktime:7.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:apple:quicktime:7.0:*:*:*:*:*:*:*
  • OR cpe:/a:apple:quicktime:7.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:apple:quicktime:7.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:apple:quicktime:7.1:*:*:*:*:*:*:*
  • OR cpe:/a:apple:quicktime:7.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:apple:quicktime:7.1.2:*:*:*:*:*:*:*
  • AND
  • cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    apple quicktime 5.0
    apple quicktime 5.0.1
    apple quicktime 5.0.2
    apple quicktime 6.0
    apple quicktime 6.1
    apple quicktime 6.5
    apple quicktime 6.5.1
    apple quicktime 6.5.2
    apple quicktime 6.5.2
    apple quicktime 6.5.2
    apple quicktime 7.0
    apple quicktime 7.0
    apple quicktime 7.0.1
    apple quicktime 7.0.1
    apple quicktime 7.0.1
    apple quicktime 7.0.1
    apple quicktime 7.0.2
    apple quicktime 7.0.2
    apple quicktime 7.0.3
    apple quicktime 7.0.4
    apple quicktime 7.1.1
    apple quicktime 7.1.2
    apple quicktime 7.0.1
    apple quicktime 7.0.3
    apple quicktime 7.0
    apple quicktime 7.0.2
    apple quicktime 7.0.4
    apple quicktime 7.1
    apple quicktime 7.1.1
    apple quicktime 7.1.2
    gentoo linux *