----------------------------------------------------------------------

Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.

The Full Featured Secunia Network Software Inspector (NSI) is now
available:
http://secunia.com/network_software_inspector/

The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,000 different Windows applications.

----------------------------------------------------------------------

TITLE:
Apple QuickTime Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA26034

VERIFY ADVISORY:
http://secunia.com/advisories/26034/

CRITICAL:
Highly critical

IMPACT:
Exposure of sensitive information, DoS, System access

WHERE:
>From remote

REVISION:
1.1 originally posted 2007-07-12

SOFTWARE:
Apple QuickTime 7.x
http://secunia.com/product/5090/

DESCRIPTION:
Some vulnerabilities have been reported in Apple QuickTime, which can
be exploited by malicious people to compromise a user's system.

1) An unspecified error exists in the processing of H.264 movies.
This can be exploited to cause memory corruption and may allow
execution of arbitrary code when a user accesses a specially crafted
H.264 movie.

2) An unspecified error exists in the processing of movie files. This
can be exploited to cause memory corruption and may allow execution of
arbitrary code when a user accesses a specially crafted movie file.

3) An integer overflow error exists in the handling of .m4v files and
can be exploited to execute arbitrary code when a user accesses a
specially crafted .m4v file.

4) An integer overflow error exists in the handling of the "author"
and "title" fields when parsing SMIL files. This can be exploited to
cause a heap-based buffer overflow and may allow execution of
arbitrary code when a user opens a specially crafted SMIL file.

5) A design error exists in QuickTime for Java, which can be
exploited to disable security checks and execute arbitrary code when
a user visits a web site containing a specially crafted Java applet.

6) A design error exists in QuickTime for Java, which can be
exploited to bypass security checks and read and write to process
memory. This can lead to execution of arbitrary code when a user
visits a web site containing a specially crafted Java applet.

7) A design error exists in QuickTime for Java due to JDirect
exposing interfaces that may allow loading arbitrary libraries and
freeing arbitrary memory. This can be exploited to execute arbitrary
code when a user visits a web site containing a specially crafted
Java applet.

8) A design error exists in QuickTime for Java, which can be
exploited to capture the user's screen content when a user visits a
web site containing a specially crafted Java applet.

The vulnerabilities are reported in versions prior to 7.2.

SOLUTION:
Update to version 7.2.

QuickTime 7.2 for Mac:
http://www.apple.com/support/downloads/quicktime72formac.html

QuickTime 7.2 for Windows:
http://www.apple.com/support/downloads/quicktime72forwindows.html

PROVIDED AND/OR DISCOVERED BY:
1) The vendor credits Tom Ferris, Security-Protocols.com and Matt
Slot, Ambrosia Software, Inc.
2) The vendor credits Jonathan 'Wolf' Rentzsch of Red Shed Software.
3) The vendor credits Tom Ferris, Security-Protocols.com.
4) David Vaartjes of ITsec Security Services, reported via iDefense.
5, 6, 7) The vendor credits Adam Gowdiak.
8) Reported by the vendor.

CHANGELOG:
2007-07-12: Added link to US-CERT.

ORIGINAL ADVISORY:
Apple:
http://docs.info.apple.com/article.html?artnum=305947

iDefense:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=556

OTHER REFERENCES:
US-CERT VU#582681:
http://www.kb.cert.org/vuls/id/582681

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------