Description
Stack-based buffer overflow in Apple QuickTime before 7.3.1, as used in QuickTime Player on Windows XP and Safari on Mac OS X, allows remote Real Time Streaming Protocol (RTSP) servers to execute arbitrary code via an RTSP response with a long Content-Type header.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 2 modules
-
MacOS X QuickTime RTSP Content-Type Overflow
exploit/osx/rtsp/quicktime_rtsp_content_type
-
Apple QuickTime 7.3 RTSP Response Header Buffer Overflow
exploit/windows/misc/apple_quicktime_rtsp_response
Exploit-DB 8
- Apple QuickTime (Mac OSX) - RTSP Content-Type Overflow (Metasploit) EDB-16873 · remote · Oct 9, 2010 · verified
- Apple QuickTime 7.3 - RTSP Response Header Buffer Overflow (Metasploit) EDB-16424 · remote · May 9, 2010 · verified
- Apple QuickTime 7.2/7.3 - RTSP Buffer Overflow EDB-11027 · remote · Jan 6, 2010 · verified
- Apple Safari / QuickTime 7.3 - RTSP Content-Type Remote Buffer Overflow EDB-6013 · remote · Jul 6, 2008 · verified
- Apple QuickTime 7.2/7.3 - RSTP Response Universal EDB-4664 · remote · Nov 27, 2007 · verified
- Apple QuickTime 7.2/7.3 (Internet Explorer 7 / Firefox / Opera) - RTSP Response Universal EDB-4657 · remote · Nov 26, 2007 · verified
- Apple QuickTime 7.2/7.3 (Windows Vista/XP) - RSTP Response Code Execution EDB-4651 · remote · Nov 24, 2007 · verified
- Apple QuickTime 7.2/7.3 - RTSP Response Remote Overwrite (SEH) EDB-4648 · dos · Nov 23, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 26549 vdb-entry
- http://www.beskerming.com/security/2007/11/25/74/QuickTime_-_Remote_hacker_automatic_control
- 3410 third-party-advisory
- 4648 exploit
- http://docs.info.apple.com/article.html?artnum=307176
- APPLE-SA-2007-12-13 vendor-advisory
- GLSA-200803-08 vendor-advisory
- 26560 vdb-entry
- TA07-334A third-party-advisory
- VU#659761 third-party-advisory
- quicktime-rtsp-contenttype-bo(38604) vdb-entry
- 6013 exploit
- ADV-2007-3984 vdb-entry
- 27755 third-party-advisory
- 29182 third-party-advisory
- 1018989 vdb-entry