CVE-2007-2175
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
60Vexday Risk Score
Corrija em breve. Ela tem exploit funcional público.
ssvc Attendepss 84%
da publicação à armano mesmo dia
Publicada no NVD24 de abr.
1ª PoC23 de abr.
metasploit23 de abr.
Apple QuickTime Java extensions (QTJava.dll), as used in Safari and other browsers, and when Java is enabled, allows remote attackers to execute arbitrary code via parameters to the toQTPointer method in quicktime.util.QTHandleRef, which can be used to modify arbitrary memory when creating QTPointerRef objects, as demonstrated during the "PWN 2 0WN" contest at CanSecWest 2007.
Produtos afetados
n/a · n/aPoCs públicas encontradas — 3✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/16295exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/9943exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/29884⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
http://cansecwest.com/post/2007-04-20-14:54:00.First_Mac_Hacked_Cancel_Or_Allowhttp://docs.info.apple.com/article.html?artnum=305446http://lists.apple.com/archives/security-announce/2007/May/msg00001.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/33827http://www.kb.cert.org/vuls/id/420668http://www.matasano.com/log/806/hot-off-the-matasano-sms-queue-cansec-macbook-challenge-won/http://www.matasano.com/log/812/breaking-macbook-vuln-in-quicktime-affects-win32-apple-code/http://www.osvdb.org/34178http://www.securityfocus.com/archive/1/467319/100/0/threadedhttp://www.securitytracker.com/id?1017950http://www.theregister.co.uk/2007/04/20/pwn-2-own_winner/http://www.zerodayinitiative.com/advisories/ZDI-07-023.html