CVE-2009-0006
Apple QuickTime Cinepak Codec MDAT Heap Corruption Vulnerability
Severity Score
9.3
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Integer signedness error in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a Cinepak encoded movie file with a crafted MDAT atom that triggers a heap-based buffer overflow.
El error en la propiedad signedness de enteros en Apple QuickTime en versiones anteriores 7.6, permite a los atacantes remotos causar una denegación de servicio (terminación de aplicación) y posiblemente ejecutar código arbitrario por medio de un archivo de película codificado de Cinepak con un átomo MDAT diseñado que desencadena un desbordamiento del búfer en la región heap de la memoria.
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple QuickTime. User interaction is required to exploit this vulnerability in that the target must open a malicious file.
The specific flaw exists in the handling of movie data encoded using the Cinepak Video Codec. When parsing the data in the MDAT atom, there exists a signedness error which leads to a heap overflow. When this occurs it can be further leveraged to execute arbitrary code under the context of the current user.
*Credits:
Anonymous
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2008-12-15 CVE Reserved
- 2009-01-21 CVE Published
- 2024-08-07 CVE Updated
- 2024-09-06 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-189: Numeric Errors
CAPEC
References (11)
| URL | Tag | Source |
|---|---|---|
| http://archives.neohapsis.com/archives/bugtraq/2009-01/0215.html | Mailing List | |
| http://osvdb.org/51529 | Vdb Entry | |
| http://support.apple.com/kb/HT3403 | X_refsource_confirm |
|
| http://www.securityfocus.com/archive/1/500391/100/0/threaded | Mailing List | |
| http://www.securityfocus.com/bid/33388 | Vdb Entry | |
| http://www.us-cert.gov/cas/techalerts/TA09-022A.html | Third Party Advisory | |
| http://www.zerodayinitiative.com/advisories/ZDI-09-007 | X_refsource_misc |
|
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6153 | Signature |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://lists.apple.com/archives/security-announce/2009/Jan/msg00000.html | 2018-10-11 |
| URL | Date | SRC |
|---|---|---|
| http://secunia.com/advisories/33632 | 2018-10-11 | |
| http://www.vupen.com/english/advisories/2009/0212 | 2018-10-11 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | <= 7.5.5 Search vendor "Apple" for product "Quicktime" and version " <= 7.5.5" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 3.0 Search vendor "Apple" for product "Quicktime" and version "3.0" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 4.1.2 Search vendor "Apple" for product "Quicktime" and version "4.1.2" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 5.0 Search vendor "Apple" for product "Quicktime" and version "5.0" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 5.0.1 Search vendor "Apple" for product "Quicktime" and version "5.0.1" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 5.0.2 Search vendor "Apple" for product "Quicktime" and version "5.0.2" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 6.0 Search vendor "Apple" for product "Quicktime" and version "6.0" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 6.0.0 Search vendor "Apple" for product "Quicktime" and version "6.0.0" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 6.0.1 Search vendor "Apple" for product "Quicktime" and version "6.0.1" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 6.0.2 Search vendor "Apple" for product "Quicktime" and version "6.0.2" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 6.1 Search vendor "Apple" for product "Quicktime" and version "6.1" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 6.1.0 Search vendor "Apple" for product "Quicktime" and version "6.1.0" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 6.1.1 Search vendor "Apple" for product "Quicktime" and version "6.1.1" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 6.2.0 Search vendor "Apple" for product "Quicktime" and version "6.2.0" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 6.3.0 Search vendor "Apple" for product "Quicktime" and version "6.3.0" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 6.4.0 Search vendor "Apple" for product "Quicktime" and version "6.4.0" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 6.5 Search vendor "Apple" for product "Quicktime" and version "6.5" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 6.5.0 Search vendor "Apple" for product "Quicktime" and version "6.5.0" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 6.5.1 Search vendor "Apple" for product "Quicktime" and version "6.5.1" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 6.5.2 Search vendor "Apple" for product "Quicktime" and version "6.5.2" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 7.0 Search vendor "Apple" for product "Quicktime" and version "7.0" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 7.0.0 Search vendor "Apple" for product "Quicktime" and version "7.0.0" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 7.0.1 Search vendor "Apple" for product "Quicktime" and version "7.0.1" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 7.0.2 Search vendor "Apple" for product "Quicktime" and version "7.0.2" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 7.0.3 Search vendor "Apple" for product "Quicktime" and version "7.0.3" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 7.0.4 Search vendor "Apple" for product "Quicktime" and version "7.0.4" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 7.1 Search vendor "Apple" for product "Quicktime" and version "7.1" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 7.1.0 Search vendor "Apple" for product "Quicktime" and version "7.1.0" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 7.1.1 Search vendor "Apple" for product "Quicktime" and version "7.1.1" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 7.1.2 Search vendor "Apple" for product "Quicktime" and version "7.1.2" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 7.1.3 Search vendor "Apple" for product "Quicktime" and version "7.1.3" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 7.1.4 Search vendor "Apple" for product "Quicktime" and version "7.1.4" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 7.1.5 Search vendor "Apple" for product "Quicktime" and version "7.1.5" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 7.1.6 Search vendor "Apple" for product "Quicktime" and version "7.1.6" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 7.2 Search vendor "Apple" for product "Quicktime" and version "7.2" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 7.2.1 Search vendor "Apple" for product "Quicktime" and version "7.2.1" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 7.3 Search vendor "Apple" for product "Quicktime" and version "7.3" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 7.3.0 Search vendor "Apple" for product "Quicktime" and version "7.3.0" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 7.3.1 Search vendor "Apple" for product "Quicktime" and version "7.3.1" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 7.3.1.70 Search vendor "Apple" for product "Quicktime" and version "7.3.1.70" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 7.4 Search vendor "Apple" for product "Quicktime" and version "7.4" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 7.4.0 Search vendor "Apple" for product "Quicktime" and version "7.4.0" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 7.4.1 Search vendor "Apple" for product "Quicktime" and version "7.4.1" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 7.4.5 Search vendor "Apple" for product "Quicktime" and version "7.4.5" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Quicktime Search vendor "Apple" for product "Quicktime" | 7.5.0 Search vendor "Apple" for product "Quicktime" and version "7.5.0" | - |
Affected
| ||||||