vulnwire
9.3crit

CVE-2007-6166in critical feed10 exploits

Stack-based buffer overflow in Apple QuickTime before 7.3.1, as used in QuickTime Player on Windows XP and Safari on Mac OS X, allows remot…

Published 18 y ago · modified 4 mo ago · JSON

CVSS
9.3
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
41.8%
percentile 99%
Public exploits
10
Metasploit · Exploit-DB

Stack-based buffer overflow in Apple QuickTime before 7.3.1, as used in QuickTime Player on Windows XP and Safari on Mac OS X, allows remote Real Time Streaming Protocol (RTSP) servers to execute arbitrary code via an RTSP response with a long Content-Type header.

Exploit prediction (EPSS)

41.77% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.

Exploits and detections

  • Metasploit exploit/windows/misc/apple_quicktime_rtsp_response Apple QuickTime 7.3 RTSP Response Header Buffer Overflow · metasploit exploit, normal rank · 2007-11-23
  • Metasploit exploit/osx/rtsp/quicktime_rtsp_content_type MacOS X QuickTime RTSP Content-Type Overflow · metasploit exploit, average rank · 2007-11-23
  • EDB-6013 Apple Safari / QuickTime 7.3 - RTSP Content-Type Remote Buffer Overflow · remote · 2008-07-06
  • EDB-4664 Apple QuickTime 7.2/7.3 - RSTP Response Universal · remote · 2007-11-27
  • EDB-4657 Apple QuickTime 7.2/7.3 (Internet Explorer 7 / Firefox / Opera) - RTSP Response Universal · remote · 2007-11-26
  • EDB-4651 Apple QuickTime 7.2/7.3 (Windows Vista/XP) - RSTP Response Code Execution · remote · 2007-11-24
  • EDB-4648 Apple QuickTime 7.2/7.3 - RTSP Response Remote Overwrite (SEH) · dos · 2007-11-23
  • EDB-16873 Apple QuickTime (Mac OSX) - RTSP Content-Type Overflow (Metasploit) · remote · 2010-10-09
  • EDB-16424 Apple QuickTime 7.3 - RTSP Response Header Buffer Overflow (Metasploit) · remote · 2010-05-09
  • EDB-11027 Apple QuickTime 7.2/7.3 - RTSP Buffer Overflow · remote · 2010-01-06

CVSS scores

Assigned byVersionScoreVector
NVD2.09.3AV:N/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

  • securityfocus.com /bid/26549 · vdb-entry, x_refsource_BID, x_transferred
  • beskerming.com /security/2007/11/25/74/QuickTime_-_Remote_hacker_automatic_control · x_refsource_MISC, x_transferred
  • securityreason.com /securityalert/3410 · third-party-advisory, x_refsource_SREASON, x_transferred
  • exploit-db.com /exploits/4648 · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • docs.info.apple.com /article.html?artnum=307176 · x_refsource_MISC, x_transferred
  • lists.apple.com /archives/Security-announce/2007/Dec/msg00000.html · vendor-advisory, x_refsource_APPLE, x_transferred
  • security.gentoo.org /glsa/glsa-200803-08.xml · vendor-advisory, x_refsource_GENTOO, x_transferred
  • securityfocus.com /bid/26560 · vdb-entry, x_refsource_BID, x_transferred
  • us-cert.gov /cas/techalerts/TA07-334A.html · third-party-advisory, x_refsource_CERT, x_transferred
  • kb.cert.org /vuls/id/659761 · third-party-advisory, x_refsource_CERT-VN, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/38604 · vdb-entry, x_refsource_XF, x_transferred
  • exploit-db.com /exploits/6013 · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • vupen.com /english/advisories/2007/3984 · vdb-entry, x_refsource_VUPEN, x_transferred
  • secunia.com /advisories/27755 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/29182 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securitytracker.com /id?1018989 · vdb-entry, x_refsource_SECTRACK, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.