| Vulnerability Name: | CVE-2008-3627 (CCN-45002) | ||||||||
| Assigned: | 2008-09-09 | ||||||||
| Published: | 2008-09-09 | ||||||||
| Updated: | 2018-10-11 | ||||||||
| Summary: | Apple QuickTime before 7.5.5 does not properly handle (1) MDAT atoms in MP4 video files within QuickTimeH264.qtx, (2) MDAT atoms in mov video files within QuickTimeH264.scalar, and (3) AVC1 atoms in an unknown media type within an unspecified component, which allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption and application crash) via a crafted, H.264 encoded movie file. | ||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||
| CVSS v2 Severity: | 9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C) 6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
5.0 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-399 | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: MITRE Type: CNA CVE-2008-3627 Source: APPLE Type: Mailing List, Vendor Advisory APPLE-SA-2008-09-09 Source: CCN Type: SA31821 Apple QuickTime Multiple Vulnerabilities Source: SECUNIA Type: Third Party Advisory 31821 Source: CCN Type: SECTRACK ID: 1020841 QuickTime PICT/Movie/QTVR/Indeo Bugs Let Remote Users Deny Service and Execute Arbitrary Code Source: SECTRACK Type: Third Party Advisory, VDB Entry 1020841 Source: CCN Type: Apple Web site About the security content of QuickTime 7.5.5 Source: CONFIRM Type: Vendor Advisory http://support.apple.com/kb/HT3027 Source: BUGTRAQ Type: UNKNOWN 20080909 ZDI-08-060: Apple QuickTime AVC1 Atom Parsing Heap Overflow Vulnerability Source: BUGTRAQ Type: UNKNOWN 20080909 ZDI-08-061: Apple QuickTime Player H.264 Parsing Heap Corruption Vulnerability Source: BUGTRAQ Type: UNKNOWN 20080909 ZDI-08-062: Apple QuickTime MDAT Frame Parsing Memory Corruption Vulnerability Source: BID Type: Patch, Third Party Advisory, VDB Entry 31086 Source: CCN Type: BID-31086 Apple QuickTime Movie/PICT/QTVR Multiple Remote Vulnerabilities Source: VUPEN Type: Third Party Advisory ADV-2008-2527 Source: MISC Type: Third Party Advisory, VDB Entry http://www.zerodayinitiative.com/advisories/ZDI-08-060/ Source: MISC Type: Third Party Advisory, VDB Entry http://www.zerodayinitiative.com/advisories/ZDI-08-061/ Source: MISC Type: Third Party Advisory, VDB Entry http://www.zerodayinitiative.com/advisories/ZDI-08-062/ Source: XF Type: UNKNOWN apple-quicktime-h264-bo(45002) Source: OVAL Type: Third Party Advisory oval:org.mitre.oval:def:16164 Source: CCN Type: ZDI-08-061 Apple QuickTime Player H.264 Parsing Heap Corruption Vulnerability | ||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||
| Vulnerability Name: | CVE-2008-3627 (CCN-45022) | ||||||||
| Assigned: | 2008-09-09 | ||||||||
| Published: | 2008-09-09 | ||||||||
| Updated: | 2008-09-09 | ||||||||
| Summary: | Apple QuickTime is vulnerable to a heap-based buffer overflow, caused by improper parsing of .mov files within QuickTimeH264.scalar. By persuading a victim to view a malicious mov file containing a specially-crafted MDAT atom, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash. | ||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||
| CVSS v2 Severity: | 9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C) 6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
5.0 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: MITRE Type: CNA CVE-2008-3627 Source: CCN Type: SA31821 Apple QuickTime Multiple Vulnerabilities Source: CCN Type: SECTRACK ID: 1020841 QuickTime PICT/Movie/QTVR/Indeo Bugs Let Remote Users Deny Service and Execute Arbitrary Code Source: CCN Type: Apple Web site About the security content of QuickTime 7.5.5 Source: CCN Type: BID-31086 Apple QuickTime Movie/PICT/QTVR Multiple Remote Vulnerabilities Source: XF Type: UNKNOWN apple-quicktime-mdat-bo(45022) Source: CCN Type: ZDI-08-062 Apple QuickTime MDAT Frame Parsing Memory Corruption Vulnerability | ||||||||
| Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||||
| Vulnerability Name: | CVE-2008-3627 (CCN-45023) | ||||||||
| Assigned: | 2008-09-09 | ||||||||
| Published: | 2008-09-09 | ||||||||
| Updated: | 2008-09-09 | ||||||||
| Summary: | Apple QuickTime is vulnerable to a heap-based buffer overflow, caused by an integer overflow when parsing AVC1 atoms. By persuading a victim to view a malicious mov file, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash. | ||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||
| CVSS v2 Severity: | 9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C) 6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
5.0 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: MITRE Type: CNA CVE-2008-3627 Source: CCN Type: SA31821 Apple QuickTime Multiple Vulnerabilities Source: CCN Type: SECTRACK ID: 1020841 QuickTime PICT/Movie/QTVR/Indeo Bugs Let Remote Users Deny Service and Execute Arbitrary Code Source: CCN Type: Apple Web site About the security content of QuickTime 7.5.5 Source: CCN Type: BID-31086 Apple QuickTime Movie/PICT/QTVR Multiple Remote Vulnerabilities Source: XF Type: UNKNOWN apple-quicktime-avc1-bo(45023) Source: CCN Type: ZDI-08-060 Apple QuickTime AVC1 Atom Parsing Heap Overflow Vulnerability | ||||||||
| Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||