[Full-Disclosure] EEYE: Apple QuickTime (QuickTime.qts) Heap Overflow

Apple QuickTime QuickTime.qts Heap Overflow Release Date: May 02, 2004 Date Reported: February 18, 2004 Severity: High Code Execution Vendor: Apple Systems Affected: Apple QuickTime 6.5 Apple iTunes 4.2.0.72 Description: The Apple QuickTime media player is used for playing, interacting with or...

CVE-2004-0169

QuickTime Streaming Server in MacOS X 10.2.8 and 10.3.2 allows remote attackers to cause a denial of service crash via DESCRIBE requests with long User-Agent fields, which causes an Assert error to be triggered in the BufferIsFull function...

Apple Quicktime/Darwin Streaming Server fails to properly parse DESCRIBE requests

Overview Apple Quicktime/Darwin Streaming Server fails to properly parse DESCRIBE requests containing overly large User-Agent fields. This could allow an unauthenticated, remote attacker to cause a denial-of-service condition. Description Apple's QuickTime and Darwin Streaming Server is software...

QuickTime/Darwin Streaming Server multiple bugs

Multiple bugs including uncommented shell characters, buffer overflows, etc...

CVE-2003-1091

Integer overflow in MP3Broadcaster for Apple QuickTime/Darwin Streaming Server 4.1.3 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via malformed ID3 tags in MP3 files...

CVE-2003-1414

Directory traversal vulnerability in parsexml.cg Apple Darwin Streaming Server 4.1.2 and Apple Quicktime Streaming Server 4.1.1 allows remote attackers to read arbitrary files via a ... triple dot in the filename parameter...

Apple QuickTime/Darwin Streaming Server integer overflow in MP3Broadcaster utility

Overview Apple's QuickTime and Darwin Streaming Server DSS package includes a utility called MP3Broadcaster. This utility contains an integer overflow which may be exploited to cause a denial of service. Description Apple's QuickTime and Darwin Streaming Server is software which provides integrat...

CVE-2003-0871

Unknown vulnerability in QuickTime Java in Mac OS X v10.3 and Mac OS X Server 10.3 allows attackers to gain "unauthorized access to a system."...

CVE-2003-0871

Unknown vulnerability in QuickTime Java in Mac OS X v10.3 and Mac OS X Server 10.3 allows attackers to gain "unauthorized access to a system."...

CVE-2003-0871

CVE-2003-0871 concerns QuickTime Java in Mac OS X v10.3 and Mac OS X Server 10.3. The description indicates an unknown vulnerability that could allow an attacker to gain unauthorized access to a system. Connected documents do not provide details beyond this, including verified affected components...

CVE-2003-0871: Undefined Security Weakness

Unknown vulnerability in QuickTime Java in Mac OS X v10.3 and Mac OS X Server 10.3 allows attackers to gain "unauthorized access to a system."...

CVE-2003-0423

parsexml.cgi in Apple QuickTime / Darwin Streaming Server before 4.1.3g allows remote attackers to obtain the source code for parseable files via the filename parameter...

CVE-2003-0502

Apple QuickTime / Darwin Streaming Server before 4.1.3g allows remote attackers to cause a denial of service crash via a .. dot dot sequence followed by an MS-DOS device name e.g. AUX in a request to HTTP port 1220, a different vulnerability than CVE-2003-0421...

CVE-2003-0424

Apple QuickTime / Darwin Streaming Server before 4.1.3f allows remote attackers to obtain the source code for scripts by appending encoded space %20 or . %2e characters to an HTTP request for the script, e.g. viewbroadcast.cgi...

CVE-2003-0425

Directory traversal vulnerability in Apple QuickTime / Darwin Streaming Server before 4.1.3f allows remote attackers to read arbitrary files via a ... triple dot in an HTTP request...

CVE-2003-0426

The installation of Apple QuickTime / Darwin Streaming Server before 4.1.3f starts the administration server with a "Setup Assistant" page that allows remote attackers to set the administrator password and gain privileges before the real administrator...

CVE-2003-0421

Apple QuickTime / Darwin Streaming Server before 4.1.3f allows remote attackers to cause a denial of service crash via an MS-DOS device name e.g. AUX in a request to HTTP port 1220, a different vulnerability than CVE-2003-0502...

CVE-2003-0422

Apple QuickTime / Darwin Streaming Server before 4.1.3f allows remote attackers to cause a denial of service crash via a request to viewbroadcast.cgi that does not contain the required parameters...

CVE-2003-0424

Apple QuickTime / Darwin Streaming Server before 4.1.3f allows remote attackers to obtain the source code for scripts by appending encoded space %20 or . %2e characters to an HTTP request for the script, e.g. viewbroadcast.cgi...

CVE-2003-0426

The installation of Apple QuickTime / Darwin Streaming Server before 4.1.3f starts the administration server with a "Setup Assistant" page that allows remote attackers to set the administrator password and gain privileges before the real administrator...