----------------------------------------------------------------------

Want a new job?
http://secunia.com/secunia_vacancies/

Secunia is looking for new researchers with a reversing background
and experience in writing exploit code:
http://secunia.com/hardcore_disassembler_and_reverse_engineer/
http://secunia.com/Disassembling_og_Reversing/

----------------------------------------------------------------------

TITLE:
Apple QuickTime Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA24359

VERIFY ADVISORY:
http://secunia.com/advisories/24359/

CRITICAL:
Highly critical

IMPACT:
System access

WHERE:
>From remote

SOFTWARE:
Apple QuickTime 7.x
http://secunia.com/product/5090/

DESCRIPTION:
Some vulnerabilities have been reported in Apple QuickTime, which
potentially can be exploited by malicious people to compromise a
user's system.

1) An integer overflow error exists in the handling of 3GP video
files.

NOTE: This does not affect QuickTime on Mac OS X.

2) A boundary error in the handling of MIDI files can be exploited to
cause a heap-based buffer overflow.

3) A boundary error in the handling of QuickTime movie files can be
exploited to cause a heap-based buffer overflow.

4) An integer overflow exists in the handling of UDTA atoms in movie
files.

5) A boundary error in the handling of PICT files can be exploited to
cause a heap-based buffer overflow.

6) A boundary error in the handling of QTIF files can be exploited to
cause a stack-based buffer overflow.

7) An integer overflow exists in the handling of QTIF files.

8) An input validation error exists in the processing of QTIF files.
This can be exploited to cause a heap corruption via a specially
crafted QTIF file with the "Color Table ID" field set to "0".

Successful exploitation of the vulnerabilities may allow execution of
arbitrary code.

SOLUTION:
Update to version 7.1.5.

Mac OS X:
http://www.apple.com/quicktime/download/mac.html

Windows:
http://www.apple.com/quicktime/download/win.html

PROVIDED AND/OR DISCOVERED BY:
1) JJ Reyes
2,5,6,7) Mike Price, McAfee AVERT Labs
3) Mike Price, McAfee AVERT Labs, Piotr Bania, and Artur Ogloza
4) Sowhat of Nevis Labs and an anonymous researcher via ZDI.
8) Ruben Santamarta via iDefense and JJ Reyes

ORIGINAL ADVISORY:
Apple:
http://docs.info.apple.com/article.html?artnum=305149

Piotr Bania:
http://www.piotrbania.com/all/adv/quicktime-heap-adv-7.1.txt

iDefense:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=486

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------