Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Update Protection against Apple QuickTime Crafted HTTP Error Response Buffer Overflow

Subscribe

Check Point Reference: CPAI-2008-398
Date Published:
Severity:
Last Updated:
Source: Secunia Advisory: SA28423
Industry Reference(s): CVE-2008-0234
Protection Provided by: Security Gateway
  • R75
Who is Vulnerable?
Apple QuickTime 7.3.1.70 and priors
Vulnerability Description
Apple QuickTime is a multimedia player that supports a wide range of media formats. The software supports parsing and displaying picture files as well as numerous audio/video stream formats, which include RSTP.
Vulnerability Details
There exists a buffer overflow vulnerability in Apple QuickTime application. The flaw is due to improper boundary protection when handling HTTP error response. A remote attacker can exploit this vulnerability by persuading the target user to visit a malicious server. Successful exploitation could allow for arbitrary code injection and execution with the privileges of the currently logged on user.
In a attack where code injection is successful, the behaviour of the target host is entirely dependent on the intended function of the injected code. The code in such a case would execute within the security context of the currently logged in user.
In an attack case where code injection is not successful, the vulnerable QuickTime application may terminate abnormally.

Protection Overview
This protection will detect and block attempts to exploit this vulnerability.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, Protection tab and select the version of your choice.

To configure the defense, select your product from the list below and follow the related protection steps.

Security Gateway R75

How Can I Protect My Network?
1. In the IPS tab, click Protections > By Protocol > IPS Software Blade > Application Intelligence > Content Protection.
2. In the right pane, double-click the Apple QuickTime Crafted HTTP Error Response Buffer Overflow protection.
3. In the Protection Details window, click on Edit. Choose the protection's Action (Override IPS Policy with: Prevent/Detect), and apply Additional Settings.
4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Content Protection Violation
Attack Information: Apple QuickTime crafted HTTP error response buffer overflow