Apple QuickTime fails to properly handle corrupt TGA images

2006-01-11T00:00:00
ID VU:115729
Type cert
Reporter CERT
Modified 2006-01-11T00:00:00

Description

Overview

Apple's QuickTime is a player for files and streaming media in a variety of different formats. A flaw in QuickTime's handling of Targa (TGA) image format files could allow a remote attacker to execute arbitrary code on a vulnerable system.

Description

Several types of overflow vulnerabilities exist in the way QuickTime handles files in the Targa (TGA) image file format. A specially crafted TGA image can allow an attacker to execute arbitrary code of their choosing with the privileges of the user running QuickTime or cause a denial of service. Apple's advisory on this issue states that a buffer overflow, integer overflow, or integer underflow error could be exploited by such a crafted image. Additional details about the underlying cause of these overflows are not known.

Note that this issue affects QuickTime installations on both Apple Mac OS X and Microsoft Windows operating systems.


Impact

An attacker with the ability to supply a maliciously crafted TGA file (.tga or .targa) could execute arbitrary code on a vulnerable system or cause a denial of service. The attacker-supplied code would be executed with the privileges of the QuickTime user opening the malicious file. The crafted TGA image may be supplied on a webpage or in email for the victim to select, or by some other means designed to encourage them to invoke QuickTime on the exploit image..


Solution

Install an update

Apple has addressed this issue with Quicktime 7.0.4, as specified in Apple Support Document 303101.


Systems Affected

Vendor| Status| Date Notified| Date Updated
---|---|---|---
Apple Computer, Inc.| | -| 11 Jan 2006
If you are a vendor and your product is affected, let us know.

CVSS Metrics

Group | Score | Vector
---|---|---
Base | N/A | N/A
Temporal | N/A | N/A
Environmental | N/A | N/A

References

  • <http://docs.info.apple.com/article.html?artnum=303101>
  • <http://secunia.com/advisories/18370/>

Credit

Thanks to Apple Product Security for reporting this vulnerability. Apple, in turn, credits Dejun Meng of Fortinet for reporting this issue to them.

This document was written by Chad R Dougherty based on information supplied by Apple.

Other Information

  • CVE IDs: CVE-2005-3707
  • Date Public: 10 Jan 2006
  • Date First Published: 11 Jan 2006
  • Date Last Updated: 11 Jan 2006
  • Severity Metric: 3.85
  • Document Revision: 11