Remote code execution vulnerability in Apple Quicktime 2000cod

Release date:
Updated on:

Affected Systems:
Apple Quicktime 7.3
Description:
--------------------------------------------------------------------------------
Cve id: CVE-2011-3250

QuickTime is a multimedia architecture developed by Apple Computer. It can process many digital videos, media paragraphs, sound effects, text, animations, music formats, and interactive panoramic images.

The JP2Deco component used by Apple QuickTime to process the mjp2 sample has a vulnerability. In this example, the COD label end (0xff52) is required, followed by the COD length value. When the content of this segment is released, the application deducts this length and passes it to the call of memcpy. Remote attackers can exploit this vulnerability to execute arbitrary code with the current user permission.

<* Source: Luigi Auriemma (aluigi@pivx.com)

Link: http://www.zerodayinitiative.com/advisories/ZDI-12-004/
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Apple
-----
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://support.apple.com/