CVE-2008-0032

Related Files

iDEFENSE Security Advisory 2008-01-15.5

Posted Jan 16, 2008

Authored by iDefense Labs, Jun Mao | Site idefense.com

iDefense Security Advisory 01.15.08 - Remote exploitation of a heap corruption vulnerability in Apple Computer Inc.'s QuickTime media player could allow attackers to execute arbitrary code in the context of the targeted user. The vulnerability specifically exists in the handling of Macintosh Resources embedded in QuickTime movies. When processing these records, a length value stored in the resource header is not properly validated. When a length value larger than the actual buffer size is supplied, potentially exploitable memory corruption occurs. iDefense Labs confirmed this vulnerability exists in QuickTime Player version 7.3.1. Previous versions are suspected to be vulnerable.

tags | advisory, remote, arbitrary

systems | apple

advisories | CVE-2008-0032

SHA-256 | 6d73e3ce9736dc59d009c05ff809807ae8052bbc094fde1bd0def439d35351b7

Download | Favorite | View