Heap-based buffer overflow in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via crafted Sample Table Sample Descriptor (STSD) atoms in a movie file.

Heap-based buffer overflow in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via crafted Sample Table Sample Descriptor (STSD) atoms in a movie file.

Heap-based buffer overflow in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via crafted Sample Table Sample Descriptor (STSD) atoms in a movie file. Apple QuickTime is prone to a heap-based buffer-overflow issue because it fails to perform adequate boundary-checks on user-supplied data. An attacker can exploit this issue by enticing an unsuspecting user to open a specially crafted movie file. Failed exploit attempts likely result in denial-of-service conditions. This issue affects Apple QuickTime running on Microsoft Windows Vista, Microsoft Windows XP SP2, and Mac OS X. Apple QuickTime is a popular multimedia player that supports a wide variety of media formats. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

National Cyber Alert System Technical Cyber Security Alert TA07-310A

Apple QuickTime Updates for Multiple Vulnerabilities

Original release date: November 06, 2007 Last revised: -- Source: US-CERT

Systems Affected

Vulnerabilities in Apple QuickTime affect * Apple Mac OS X * Microsoft Windows

Overview

Apple QuickTime contains multiple vulnerabilities.

I. Description

Apple QuickTime 7.3 resolves multiple vulnerabilities in the way different types of image and media files are handled.

Note that Apple iTunes installs QuickTime, so any system with iTunes is vulnerable.

II. For further information, please see About the security content of QuickTime 7.3.

III. Solution

Upgrade Quic…