Note: This page is part of the archive.

This document is part of the US-CERT website archive. These documents are no longer updated and may contain outdated information. Links may also no longer function. Please contact if you have any questions about the US-CERT website archive.

Alert (TA07-005A)

Apple QuickTime RTSP Buffer Overflow

Systems Affected

Apple QuickTime on systems running
  • Apple Mac OS X
  • Microsoft Windows
Note that Apple iTunes and other software using the vulnerable QuickTime components are also affected.


Apple QuickTime contains a buffer overflow in the handling of RTSP URLs. This can allow a remote attacker to execute arbitrary code on a vulnerable system.


A vulnerability exists in the way Apple QuickTime handles specially crafted Real Time Streaming Protocol (RTSP) URL strings. Public exploit code is available that demonstrates how opening a .QTL file triggers the buffer overflow. However, we have confirmed that other attack vectors for the vulnerability also exist.

Possible attack vectors include

  • a web page that uses the QuickTime plug-in or ActiveX control
  • a web page that uses the rtsp:// protocol
  • a file that is associated with the QuickTime Player

US-CERT is tracking this issue as VU#442497. This reference number corresponds to CVE-2007-0015.

Note that this vulnerability affects QuickTime on Microsoft Windows and Apple Mac platforms. Although web pages can be used as attack vectors, this vulnerability is not dependent on the specific web browser that is used.


By convincing a user to open specially crafted QuickTime content, a remote, unauthenticated attacker can execute arbitrary code on a vulnerable system.


Install an update

Apple has released Security Update 2007-001.

The Mac OS X update is available via Software Update or from Apple Downloads.

The Microsoft Windows update is available through Apple Software Update, which is included with QuickTime 7.1.3. An updated version of "%ProgramFiles%\QuickTime\QuickTimePlayer.exe" has file version


Revision History

  • January 05, 2007: Initial release
    January 23, 2007: Updated Solution section
    January 24, 2007: Updated Solution section with Windows information

This product is provided subject to this Notification and this Privacy & Use policy.

Was this document helpful?  Yes  |  Somewhat  |  No