|
|
| |
Credit:
The information has been provided by Moritz Jodeit.
The original article can be found at: http://www.zerodayinitiative.com/advisories/ZDI-10-258/
|
| |
Vulnerable Systems:
* Apple Quicktime
The specific flaw exists within the Quicktime.qts module responsible for parsing media files. While handling 3GP streams a function within this module a loop trusts a value directly from the media file and uses it during memory copy operations. By supplying a large enough value this buffer can be overflowed leading to arbitrary code execution under the context of the user accessing the file.
Patch Availability:
Apple has issued an update to correct this vulnerability.
More details can be found at: http://support.apple.com/kb/HT4447
CVE Information:
CVE-2010-1508
Disclosure Timeline:
2010-01-06 - Vulnerability reported to vendor
2010-12-07 - Coordinated public release of advisory
|
|
|
