Remote Code Execution Vulnerability in QTVR files earlier than Apple QuickTime 7.7.2

Release date:
Updated on:

Affected Systems:
Apple QuickTime Player 7.x
Unaffected system:
Apple QuickTime Player 7.7.2
Description:
--------------------------------------------------------------------------------
Bugtraq id: 53583
Cve id: CVE-2012-0667

QuickTime is a multimedia architecture developed by Apple Computer. It can process many digital videos, media paragraphs, sound effects, text, animations, music formats, and interactive panoramic images.

In versions earlier than Apple QuickTime 7.7.2 on Windows, when processing special QTVR video files, there is an integer signature error, which allows remote attackers to execute arbitrary code or cause DOS.

<* Source: Alin Rad Pop

Link: http://secunia.com/advisories/47447/
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Apple
-----
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://support.apple.com/