Apple QuickTime RTSP Buffer Overflow
- Apple Mac OS X
- Microsoft Windows
Apple QuickTime contains a buffer overflow in the handling of RTSP URLs. This can allow a remote attacker to execute arbitrary code on a vulnerable system.
A vulnerability exists in the way Apple QuickTime handles specially crafted Real Time Streaming Protocol (RTSP) URL strings. Public exploit code is available that demonstrates how opening a .QTL file triggers the buffer overflow. However, we have confirmed that other attack vectors for the vulnerability also exist.
Possible attack vectors include
- a web page that uses the QuickTime plug-in or ActiveX control
- a web page that uses the rtsp:// protocol
- a file that is associated with the QuickTime Player
Note that this vulnerability affects QuickTime on Microsoft Windows and Apple Mac platforms. Although web pages can be used as attack vectors, this vulnerability is not dependent on the specific web browser that is used.
By convincing a user to open specially crafted QuickTime content, a remote, unauthenticated attacker can execute arbitrary code on a vulnerable system.
Install an update
Apple has released Security Update 2007-001.
The Microsoft Windows update is available through Apple Software Update, which is included with QuickTime 7.1.3. An updated version of "%ProgramFiles%\QuickTime\QuickTimePlayer.exe" has file version 18.104.22.168.
- US-CERT Vulnerability Note VU#442497 - http://www.kb.cert.org/vuls/id/442497
- Securing Your Web Browser - http://www.us-cert.gov/reading_room/securing_browser/
- About Security Update 2007-001 - http://docs.info.apple.com/article.html?artnum=304989
- Mac OS X: Updating your software - http://docs.info.apple.com/article.html?artnum=106704
- Apple - Support - Search Results - http://search.info.apple.com/?search=Go&q=2007-001
- How to repair Software Update for Windows - http://docs.info.apple.com/article.html?artnum=304264
- Apple - QuickTime - Download - http://www.apple.com/quicktime/download/win.html
- CVE-2007-0015 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0015
January 05, 2007: Initial release
January 23, 2007: Updated Solution section
January 24, 2007: Updated Solution section with Windows information