CVE-2003-0423: Undefined Security Weakness

parsexml.cgi in Apple QuickTime / Darwin Streaming Server before 4.1.3g allows remote attackers to obtain the source code for parseable files via the filename parameter...

CVE-2003-0426: Undefined Security Weakness

The installation of Apple QuickTime / Darwin Streaming Server before 4.1.3f starts the administration server with a "Setup Assistant" page that allows remote attackers to set the administrator password and gain privileges before the real administrator...

CVE-2003-0422: Undefined Security Weakness

Apple QuickTime / Darwin Streaming Server before 4.1.3f allows remote attackers to cause a denial of service crash via a request to viewbroadcast.cgi that does not contain the required parameters...

[Full-Disclosure] R7-0015: Multiple Vulnerabilities Apple QuickTime/Darwin Streaming Server

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Rapid7, Inc. Security Advisory Visit http://www.rapid7.com/ to download NeXpose, the world's most advanced vulnerability scanner. Linux and Windows 2000/XP versions are available now! Rapid7 Advisory R7-0015 Multiple Vulnerabilities Apple...

Re: QuickTime/Darwin Streaming Server security issues

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Greetings. I'm having trouble reproducing this vulnerability as well. See below: jdog@wonderland jdog$ cat /etc/redhat-release jdog's Super Tricked-out Red Hat Linux release 8.0 Psyche jdog@wonderland jdog$ echo -ne "OPTIONS RTSP/1.0nCseq: 1nn" | nc...

QuickTime/Darwin Streaming Server security issues

// @Security advisory: QuickTime/Darwin Streaming server security issues Release date: May 22, 2003 Name: QuickTime/Darwin Streaming server security issues Author: Sir Mordred [email protected] I. DESCRIPTION Darwin Streaming Server DSS is server technology which allows you to send streaming...

Apple QuickTimeDarwin Streaming Server 4.1.3 QTSSReflector Module - Integer Overflow

Apple QuickTimeDarwin Streaming Server 4.1.3 QTSSReflector Module - Integer Overflow source: https://www.securityfocus.com/bid/7659/info A vulnerability has been reported for Apple QuickTime/Darwin Streaming Server. The problem is said to occur within the QTSSReflector module while processing the...

Apple QuickTime/Darwin Streaming Server 4.1.3 QTSSReflector Module - Integer Overflow

source: https://www.securityfocus.com/bid/7659/info A vulnerability has been reported for Apple QuickTime/Darwin Streaming Server. The problem is said to occur within the QTSSReflector module while processing the ANNOUNCE command. Specifically, by specifying an extremely large value as an argumen...

CVE-2003-0050

parsexml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to execute arbitrary code via shell metacharacters...

CVE-2003-0053

Cross-site scripting XSS vulnerability in parsexml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to insert arbitrary script via the filename parameter, which is inserted into an error message...

CVE-2003-0054

Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to execute certain code via a request to port 7070 with the script in an argument to the rtsp DESCRIBE method, which is inserted into a log file and executed when the log is viewed usin...

CVE-2003-0055

Buffer overflow in the MP3 broadcasting module of Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to execute arbitrary code via a long filename...

Re: QuickTime/Darwin Streaming Administration Server Multiple vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Word. I've found two other issues in QuickTime Streaming Server v4.1.1 that seem to be fixed in the newest v4.1.3: 1. File probing: Request: http://localhost:1220/parsexml.cgi?filename=../nonexistent Response: 'Can't access HTML file '../nonexistent'!...

Apple QuickTimeDarwin Streaming Server 4.1.x - parse_xml.cgi File Disclosure

Apple QuickTimeDarwin Streaming Server 4.1.x - parsexml.cgi File Disclosure source: https://www.securityfocus.com/bid/6990/info A file retrieval vulnerability has been reported for QuickTime/Darwin Streaming Server. The vulnerability exists due to insufficient sanitization of some parameters give...

QuickTime/Darwin Streaming Administration Server Multiple vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 @stake, Inc. www.atstake.com Security Advisory Advisory Name: QuickTime/Darwin Streaming Administration Server Multiple vulnerabilities Release Date: 03-24-2003 Application: Darwin Streaming Server 4.1.2 QuickTime Streaming Server 4.1.1 Platform: MacO...

Darwin Streaming Server 4.1.2 - parse_xml.cgi Code Execution

Darwin Streaming Server 4.1.2 - parsexml.cgi Code Execution !/usr/bin/perl QTTS REMOTE ROOT exploit by FOXMULDER [email protected] FOXMULDER PRESENTS foxmulderatabv.bg DarwinOSX4.x? 5.X QTSSQuick Time Stream Server 3.X The bug in Darwin 5.X with unpatched QTSS in parsexml.cgi which lead to remote...

Darwin Streaming Server <= 4.1.2 (parse_xml.cgi) Code Execution Exploit

No description provided by source. !/usr/bin/perl QTTS REMOTE ROOT exploit by FOXMULDER [email protected] FOXMULDER PRESENTS foxmulderatabv.bg DarwinOSX4.x? 5.X QTSSQuick Time Stream Server 3.X The bug in Darwin 5.X with unpatched QTSS in parsexml.cgi which lead to remote root compromise: $filenam...

QuickTime Streaming Server parse_xml.cgi Remote Execution

The QuickTime Streaming Server contains a CGI script that is vulnerable to metacharacter injection, allow arbitrary commands to be executed as root. Module Options msf use exploit/unix/webapp/qtss/parsexmlexec msf undefinedparsexmlexec show actions ...actions... msf undefinedparsexmlexec set ACTI...

Darwin Streaming Server <= 4.1.2 (parse_xml.cgi) Code Execution Expl

Exploit for macOS platform in category remote exploits ======================================================================= Darwin Streaming Server 'filename'; $templatefile = $query-'template'; Based on http://wbyte.ath.cx/wbyte/researches/qtss-core.txt use IO::Socket; use LWP::Simple; use LW...

Darwin Streaming Server 4.1.2 - 'parse_xml.cgi' Code Execution

!/usr/bin/perl QTTS REMOTE ROOT exploit by FOXMULDER [email protected] FOXMULDER PRESENTS foxmulderatabv.bg DarwinOSX4.x? 5.X QTSSQuick Time Stream Server 3.X The bug in Darwin 5.X with unpatched QTSS in parsexml.cgi which lead to remote root compromise: $filename = $query-'filename'; $templatefil...