TITLE:
QuickTime Multiple Code Execution Vulnerabilities

SECUNIA ADVISORY ID:
SA20069

VERIFY ADVISORY:
http://secunia.com/advisories/20069/

CRITICAL:
Highly critical

IMPACT:
DoS, System access

WHERE:
>From remote

SOFTWARE:
Apple Quicktime 4.x
http://secunia.com/product/7923/
Apple Quicktime 5.x
http://secunia.com/product/215/
Apple Quicktime 6.x
http://secunia.com/product/810/
Apple QuickTime 7.x
http://secunia.com/product/5090/

DESCRIPTION:
Multiple vulnerabilities have been reported in QuickTime, which can
be exploited by malicious people to compromise a user's system.

1) An integer overflow error within the processing of JPEG images can
be exploited via a specially crafted JPEG image to crash the
application and potentially execute arbitrary code.

2) An integer overflow and boundary error within the processing of
QuickTime movies can be exploited via a specially crafted QuickTime
movie to crash the application and potentially execute arbitrary
code.

3) A boundary error within the processing of Flash movies can be
exploited via a specially crafted Flash movie to crash the
application and potentially execute arbitrary code.

4) An integer overflow and boundary error within the processing of
H.264 movies can be exploited via a specially crafted H.264 movie to
crash the application and potentially execute arbitrary code.

5) A boundary error within the processing of MPEG4 movies can be
exploited via a specially crafted MPEG4 movie to crash the
application and potentially execute arbitrary code.

6) An integer overflow error within the processing of FlashPix images
(".fpx") can be exploited via a specially crafted FlashPix image with
an overly large value in the field specifying the number of data
blocks in the file. This can be exploited to cause a heap-based
buffer overflow and allows execution of arbitrary code.

7) A boundary error within the processing of AVI movies can be
exploited via a specially crafted AVI movie to crash the application
and potentially execute arbitrary code.

8) Two boundary errors within the processing of PICT images can be
exploited to either cause a stack-based via a PICT image with
specially crafted font information or a heap-based buffer overflow
via a PICT image with specially crafted image data. This can be
exploited to crash the application and potentially execute arbitrary
code.

9) A boundary error within the processing of BMP images can be
exploited via a specially crafted BMP image to crash the application
and potentially execute arbitrary code.

SOLUTION:
Update to version 7.1.
http://www.apple.com/support/downloads/quicktime71.html

PROVIDED AND/OR DISCOVERED BY:
1) Reported by the vendor.
2) Mike Price of McAfee AVERT Labs and Sowhat of Nevis Labs.
3) Mike Price, McAfee AVERT Labs.
4) Mike Price of McAfee AVERT Labs and ATmaCA.
5) Mike Price, McAfee AVERT Labs.
6) Fang Xing of eEye Digital Security and Mike Price of McAfee AVERT
Labs.
7) Mike Price, McAfee AVERT Labs.
8) Mike Price, McAfee AVERT Labs.
9) Tom Ferris

ORIGINAL ADVISORY:
Apple:
http://docs.info.apple.com/article.html?artnum=303752

eEye Digital Security:
http://www.eeye.com/html/research/advisories/AD20060511.html

Zero Day Initiative:
http://www.zerodayinitiative.com/advisories/ZDI-06-015.html

Sowhat:
http://secway.org/advisory/AD20060512.txt

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------