Published: 29/11/2007 Updated: 30/10/2018

CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6

VMScore: 970

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Stack-based buffer overflow in Apple QuickTime prior to 7.3.1, as used in QuickTime Player on Windows XP and Safari on Mac OS X, allows remote Real Time Streaming Protocol (RTSP) servers to execute arbitrary code via an RTSP response with a long Content-Type header.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apple quicktime 7.0.1
apple quicktime 6.5.1
apple quicktime 5.0
apple quicktime 6.0
apple quicktime 7.1.4
apple quicktime 3.0
apple quicktime 7.0.4
apple quicktime 7.1.1
apple quicktime 7.0.3
apple quicktime 7.1.2
apple quicktime
apple quicktime 4.1.2
apple quicktime 7.0.2
apple quicktime -
apple quicktime 5.0.1
apple quicktime 6.5
apple quicktime 7.1.3
apple quicktime 7.1.6
apple quicktime 7.0
apple quicktime 6.5.2
apple quicktime 6.1
apple quicktime 5.0.2
apple quicktime 7.1
apple quicktime 7.1.5
apple quicktime 7.2
apple safari

## # $Id: apple_quicktime_rtsp_responserb 9262 2010-05-09 17:45:00Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions Please see the Metasploit # Framework web site for more information on licensing and terms of use # metasploitcom/framework/ ## class Metasp ...

# Exploit Title: Apple QuickTime 72/73 RTSP BOF (Perl) # Date: 2009-01-06 # Author: Jacky # Software Link: [downoad link if available] # Version: 72/73 # Tested on: Windows XP SP3 # CVE : [if exists] # Code : #Apple QuickTime 72/73 RTSP BOF (Perl Edition ) #Discovered by (Krystian Kloskowski (h07) <h07@interiapl>) #Written and coded by ...

#!/usr/bin/perl # # quickbitepl # # Safari + Quicktime <= 73 RTSP Content-Type overflow exploit # for Mac OS X (Intel) # # Tested with OS X 104 # On victim, browse to server:8080/ # Binds shell on port 4444 # # by krafty # # greets to sk, halvar, grugq, and all the ethnical hackers # extra thanks to ddz for osx hackery # sec-con gre ...

___ Everyone Loves O|0_+|O the Hypnotoad || | | =o0O=====O0o=============================== | QuickTime RTSP Response Content-type | | remote stack rewrite exploit for IE 6/7 | | by Yag Kohha (skyhole [at] gmailcom) | =========================================== Exploit tested on: - W ...

## # $Id: quicktime_rtsp_content_typerb 10617 2010-10-09 06:55:52Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions Please see the Metasploit # Framework web site for more information on licensing and terms of use # metasploitcom/framework/ ## require 'msf/ ...

#!/usr/bin/python # Apple QuickTime 73 RTSP Response 0day Remote SEH Overwrite PoC Exploit # Bug discovered by Krystian Kloskowski (h07) <h07@interiapl> # Tested on: Apple QuickTime Player 73 / XP SP2 Polish # Details: # # (RTSP) Content-Type: [A * 995] + [B * 4096]\r\n # # 0x41414141 Pointer to next SEH record # 0x42424242 SE handler ...

#!/usr/bin/python ########################################################################## # wwwoffensive-securitycom # Bug discovered by Krystian Kloskowski (h07) <h07@interiapl> # Tested on: Apple QuickTime Player 73 / 72 IE7,FF /Opera, XP SP2, Vista # This exploit is completely "Universal" It has also been modded to work ...

/* ============================================================= Apple Quicktime (Vista/XP RSTP Response) Remote Code Exec ============================================================= Discovered by: h07 Author: InTeL *Tested on: - Quicktime 73 on Windows Vista, Result: SEH Overwrite, Code Exec - Quicktime 72 on Windows Vista, Result: SEH ...

CWE-119 http://www.beskerming.com/security/2007/11/25/74/QuickTime_-_Remote_hacker_automatic_control http://www.kb.cert.org/vuls/id/659761 http://www.securityfocus.com/bid/26549 http://www.securitytracker.com/id?1018989 http://secunia.com/advisories/27755 http://docs.info.apple.com/article.html?artnum=307176 http://lists.apple.com/archives/Security-announce/2007/Dec/msg00000.html http://www.us-cert.gov/cas/techalerts/TA07-334A.html http://www.securityfocus.com/bid/26560 http://security.gentoo.org/glsa/glsa-200803-08.xml http://secunia.com/advisories/29182 http://securityreason.com/securityalert/3410 http://www.vupen.com/english/advisories/2007/3984 https://exchange.xforce.ibmcloud.com/vulnerabilities/38604 https://www.exploit-db.com/exploits/6013 https://www.exploit-db.com/exploits/4648 https://nvd.nist.gov https://www.exploit-db.com/exploits/16424/https://www.kb.cert.org/vuls/id/659761

Get Started

CVE-2007-6166

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect