medium6.8Public exploit code
CVE-2007-0059
Cross-zone scripting vulnerability in Apple Quicktime 3 to 7.1.3 allows remote user-assisted attackers to execute arbitrary code and list filesystem contents v…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Apple QuickTime 7.1.3 - 'HREFTrack' Cross-Zone Scripting2007-01-03 · remote · osx · Verified
Impact
Cross-zone scripting vulnerability in Apple Quicktime 3 to 7.1.3 allows remote user-assisted attackers to execute arbitrary code and list filesystem contents via a QuickTime movie (.MOV) with an HREF Track (HREFTrack) that contains an automatic action tag with a local URI, which is executed in a local zone during preview, as exploited by a MySpace worm.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apple | Quicktime | through 7.1.3 Version 3.0 |
References
- NVD record
- CVE.org record
- http://docs.info.apple.com/article.html?artnum=305149
- http://lists.apple.com/archives/Security-announce/2007/Mar/msg00000.html
- http://osvdb.org/31164
- http://projects.info-pull.com/moab/MOAB-03-01-2007.html
- http://www.gnucitizen.org/blog/backdooring-quicktime-movies/
- http://www.kb.cert.org/vuls/id/304064
- http://docs.info.apple.com/article.html?artnum=305149
- http://lists.apple.com/archives/Security-announce/2007/Mar/msg00000.html
- http://osvdb.org/31164
- http://projects.info-pull.com/moab/MOAB-03-01-2007.html
- http://www.gnucitizen.org/blog/backdooring-quicktime-movies/
- http://www.kb.cert.org/vuls/id/304064