Buffer overflow in Apple QuickTime and iTunes - CVE-2007-6166

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when handling specially crafted overly long RTSP (Real Time Streaming Protocol) Response Content-Type header. A remote attacker can create a specially crafted web page, trick the victim into opening it, cause buffer overflow and execute arbitrary code on vulnerable system.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Affected software

How to mitigate CVE-2007-6166

Links to Public Exploits and PoC-codes

• Exploit #607 - Apple QuickTime (Mac OSX) - RTSP Content-Type Overflow (Metasploit) (March 18, 2020)
• Exploit #608 - Apple QuickTime 7.3 - RTSP Response Header Buffer Overflow (Metasploit) (March 18, 2020)
• Exploit #609 - Apple QuickTime 7.2/7.3 - RTSP Buffer Overflow (Perl) (March 18, 2020)
• Exploit #610 - Apple Safari / QuickTime 7.3 - RTSP Content-Type Remote Buffer Overflow (March 18, 2020)
• Exploit #611 - Apple QuickTime 7.2/7.3 - RSTP Response Universal Exploit (March 18, 2020)
• Exploit #612 - Apple QuickTime 7.2/7.3 (Internet Explorer 7 / Firefox / Opera) - RTSP Response Universal Exploit (March 18, 2020)
• Exploit #613 - Apple QuickTime 7.2/7.3 (Windows Vista / Windows XP) - RSTP Response Code Execution (March 18, 2020)
• Exploit #614 - Apple QuickTime 7.2/7.3 - RTSP Response Remote Overwrite (SEH) (March 18, 2020)
• Exploit #1602 - Apple QuickTime 7.3 RTSP Response Header Buffer Overflow (March 18, 2020)
• Exploit #1745 - MacOS X QuickTime RTSP Content-Type Overflow (March 18, 2020)

External References

• http://docs.info.apple.com/article.html?artnum=307176
• http://www.us-cert.gov/cas/alerts/SA07-334A.html
• http://www.us-cert.gov/cas/techalerts/TA07-334A.html
• http://www.kb.cert.org/vuls/id/659761

Related Security Bulletins

• Remote code execution in Apple QuickTime