CVE-2007-5045

Severity Score

9.3

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Argument injection vulnerability in Apple QuickTime 7.1.5 and earlier, when running on systems with Mozilla Firefox before 2.0.0.7 installed, allows remote attackers to execute arbitrary commands via a QuickTime Media Link (QTL) file with an embed XML element and a qtnext parameter containing the Firefox "-chrome" argument. NOTE: this is a related issue to CVE-2006-4965 and the result of an incomplete fix for CVE-2007-3670.

Vulnerabilidad de inyección de argumentos en Apple QuickTime 7.1.5 y anteriores, cuando se ejecutan en sistemas con Mozilla Firefox anterior a 2.0.0.7 instalado, permite a atacantes remotos ejecutar comandos de su elección mediante un archivo de Enlace a Medios QuickTime (QuickTime Media Link o QTL) con un elemento XML embed y un parámetro qtnext que contiene el argumento de Firefox "-chrome". NOTA: este es un problema relacionado con CVE-2006-4965 y el resultado de un arreglo incompleto para CVE-2007-3670.

*Credits: N/A

CVSS Scores

NISTv2 9.3

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2007-09-23 CVE Reserved
2007-09-24 CVE Published
2024-08-07 CVE Updated
2024-09-04 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-94: Improper Control of Generation of Code ('Code Injection')

CAPEC

References (10)

URL	Tag	Source
http://www.gnucitizen.org/blog/0day-quicktime-pwns-firefox	X_refsource_misc
http://www.securityfocus.com/archive/1/479179/100/0/threaded	Mailing List
http://www.vupen.com/english/advisories/2007/3197	Vdb Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=395942	X_refsource_misc
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5896	Signature

URL	Date	SRC

URL	Date	SRC
http://secunia.com/advisories/26881	2018-10-15
http://www.mozilla.org/security/announce/2007/mfsa2007-28.html	2018-10-15

URL	Date	SRC
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742	2018-10-15
http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1	2018-10-15
http://www.novell.com/linux/security/advisories/2007_57_mozilla.html	2018-10-15

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Apple Search vendor "Apple"		Quicktime Search vendor "Apple" for product "Quicktime"				<= 7.1.5 Search vendor "Apple" for product "Quicktime" and version " <= 7.1.5"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				<= 2.0.0.6 Search vendor "Mozilla" for product "Firefox" and version " <= 2.0.0.6"		-		Affected