apple darwin streaming server 4.1.2 vulnerabilities and exploits

(subscribe to this query)

10

CVSSv2

Heap-based buffer overflow in Apple Darwin Streaming Proxy, when using Darwin Streaming Server prior to 5.5.5, allows remote malicious users to execute arbitrary code via multiple trackID values in a SETUP RTSP request.

Apple Darwin Streaming Server 4.1.2 Apple Darwin Streaming Server 5.0.1 Apple Darwin Streaming Server 5.5.4 Apple Darwin Streaming Server 4.1.3

10

CVSSv2

Multiple stack-based buffer overflows in the is_command function in proxy.c in Apple Darwin Streaming Proxy, when using Darwin Streaming Server prior to 5.5.5, allow remote malicious users to execute arbitrary code via a long (1) cmd or (2) server value in an RTSP request.

Apple Darwin Streaming Server 4.1.2 Apple Darwin Streaming Server 5.0.1 Apple Darwin Streaming Server 5.5.4 Apple Darwin Streaming Server 4.1.3

4.3

CVSSv2

parse_xml.cgi in Apple Darwin Streaming Server 4.1.1 allows remote malicious users to determine the existence of arbitrary files by using ".." sequences in the filename parameter and comparing the resulting error messages.

Apple Darwin Streaming Server 4.1.2 Apple Quicktime Streaming Server 4.1.1

4.3

CVSSv2

Directory traversal vulnerability in parse_xml.cg Apple Darwin Streaming Server 4.1.2 and Apple Quicktime Streaming Server 4.1.1 allows remote malicious users to read arbitrary files via a ... (triple dot) in the filename parameter.

Apple Darwin Streaming Server 4.1.2 Apple Quicktime Streaming Server 4.1.1

1 EDB exploit

7.5

CVSSv2

parse_xml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote malicious users to execute arbitrary code via shell metacharacters.

Apple Darwin Streaming Server 4.1.2 Apple Quicktime Streaming Server 4.1.1

1 EDB exploit

5

CVSSv2

parse_xml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote malicious users to obtain the physical path of the server's installation path via a NULL file parameter.

Apple Quicktime Streaming Server 4.1.1 Apple Darwin Streaming Server 4.1.2

5

CVSSv2

parse_xml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote malicious users to list arbitrary directories.

Apple Darwin Streaming Server 4.1.2 Apple Quicktime Streaming Server 4.1.1

4.3

CVSSv2

Cross-site scripting (XSS) vulnerability in parse_xml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote malicious users to insert arbitrary script via the filename parameter, which is inserted into an error message.

Apple Darwin Streaming Server 4.1.2 Apple Quicktime Streaming Server 4.1.1

7.5

CVSSv2

Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote malicious users to execute certain code via a request to port 7070 with the script in an argument to the rtsp DESCRIBE method, which is inserted into a log file and executed when...

Apple Darwin Streaming Server 4.1.2 Apple Quicktime Streaming Server 4.1.1

7.5

CVSSv2

Buffer overflow in the MP3 broadcasting module of Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote malicious users to execute arbitrary code via a long filename.

Apple Quicktime Darwin Mp3 Broadcaster

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook