Heap-based buffer overflow in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via an invalid color table size when parsing the color table atom (CTAB) in a movie file, related to the CTAB RGB values.

Heap-based buffer overflow in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via an invalid color table size when parsing the color table atom (CTAB) in a movie file, related to the CTAB RGB values.

Heap-based buffer overflow in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via an invalid color table size when parsing the color table atom (CTAB) in a movie file, related to the CTAB RGB values. Apple QuickTime contains a buffer overflow vulnerability. If exploited, this vulnerability may allow an attacker to execute code. User interaction is required to exploit this vulnerability in that the target must open a malicious file.The specific flaw exists in the parsing of the CTAB atom. This memory corruption can lead to the execution of arbitrary code. Apple QuickTime is prone to a heap-based buffer-overflow issue because it fails to perform adequate boundary checks on user-supplied data. An attacker can exploit this issue by enticing an unsuspecting user to open a specially crafted movie file. Failed exploit attempts likely result in denial-of-service conditions. This issue affects Apple QuickTime running on Microsoft Windows Vista, Microsoft Windows XP SP2, and Mac OSX. Apple QuickTime is a popular multimedia player that supports a wide variety of media formats. ZDI-07-065: Apple QuickTime Color Table RGB Parsing Heap Corruption Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-07-065.html November 5, 2007

-- CVE ID: CVE-2007-4677

-- Affected Vendor: Apple

-- Affected Products: QuickTime 7.2

-- TippingPoint(TM) IPS Customer Protection: TippingPoint IPS customers have been protected against this vulnerability by Digital Vac…