QuickTime Input Validation Flaw in MPEG-2 Playback Component for Windows Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID: 1021621|
SecurityTracker URL: http://securitytracker.com/id/1021621
(Links to External Site)
Date: Jan 22 2009
Execution of arbitrary code via network, User access via network|
Fix Available: Yes Vendor Confirmed: Yes |
Version(s): MPEG-2 Playback Component for Windows prior to 188.8.131.52|
A vulnerability was reported in the QuickTime MPEG-2 Playback Component for Windows. A remote user can cause arbitrary code to be executed on the target user's system.|
A remote user can create a specially crafted MPEG-2 movie file that, when loaded by the target user, will execute arbitrary code on the target system. The code will run with the privileges of the target user.
The QuickTime MPEG-2 Playback Component is not installed by default with QuickTime.
Systems running Mac OS X are not affected.
Richard Lemon of Code Lemon reported this vulnerability.
A remote user can create a file that, when loaded by the target user, will execute arbitrary code on the target user's system.|
The vendor has issued a fix (184.108.40.206).|
Users of earlier versions of the QuickTime MPEG-2 Playback Component from the Apple Store can download the updated version for free.
The vendor's advisory is available at:
Vendor URL: support.apple.com/kb/HT3404 (Links to External Site)
Input validation error|
|Underlying OS: Windows (Vista), Windows (XP)|
Source Message Contents
Subject: APPLE-SA-2009-01-21 QuickTime MPEG-2 Playback Component|
-----BEGIN PGP SIGNED MESSAGE-----
APPLE-SA-2009-01-21 QuickTime MPEG-2 Playback Component
The QuickTime MPEG-2 Playback Component for Windows is now available
and addresses the following issue:
Available for: Windows Vista, XP SP2 and SP3
Impact: Viewing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description: An input validation issue exists in the QuickTime
MPEG-2 Playback Component for Windows. Accessing a maliciously
crafted movie file may lead to an unexpected application termination
or arbitrary code execution. This update addresses the issue by
performing additional validation of MPEG-2 files. This issue does not
affect systems running Mac OS X. Credit to Richard Lemon of Code
Lemon for reporting this issue.
The QuickTime MPEG-2 Playback Component is not installed by default,
and is provided separately from QuickTime. Details are available via
http://www.apple.com/quicktime/mpeg2/ Users who have paid for and
downloaded an earlier version of the QuickTime MPEG-2 Playback
Component from the Apple Store may download the updated version for
The steps to determine that a system has the updated version are
listed at http://support.apple.com/kb/HT3381.
The version number of the updated QuickTime MPEG-2 Playback
Component for Windows is 220.127.116.11.
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (Darwin)
-----END PGP SIGNATURE-----
Do not post admin requests to the list. They will be ignored.
Security-announce mailing list (Securityfirstname.lastname@example.org)