Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2010-1818

The IPersistPropertyBag2::Read function in QTPlugin.ocx in Apple QuickTime 6.x, 7.x before 7.6.8, and other versions allows remote attackers to execute arbitrary code via the _Marshaled_pUnk attribute, which triggers unmarshalling of an untrusted pointer.

Published

2010-08-31T20:00:01.420

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 9.3 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

8.6

Impact Score

10.0

Weaknesses

Type: Primary
CWE-824

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	apple	quicktime	6.0	Yes
Application	apple	quicktime	6.0.0	Yes
Application	apple	quicktime	6.0.1	Yes
Application	apple	quicktime	6.0.2	Yes
Application	apple	quicktime	6.1	Yes
Application	apple	quicktime	6.1.0	Yes
Application	apple	quicktime	6.1.1	Yes
Application	apple	quicktime	6.2.0	Yes
Application	apple	quicktime	6.3.0	Yes
Application	apple	quicktime	6.4.0	Yes
Application	apple	quicktime	6.5	Yes
Application	apple	quicktime	6.5.0	Yes
Application	apple	quicktime	6.5.1	Yes
Application	apple	quicktime	6.5.2	Yes
Application	apple	quicktime	7.0	Yes
Application	apple	quicktime	7.0.0	Yes
Application	apple	quicktime	7.0.1	Yes
Application	apple	quicktime	7.0.2	Yes
Application	apple	quicktime	7.0.3	Yes
Application	apple	quicktime	7.0.4	Yes
Application	apple	quicktime	7.1	Yes
Application	apple	quicktime	7.1.0	Yes
Application	apple	quicktime	7.1.1	Yes
Application	apple	quicktime	7.1.2	Yes
Application	apple	quicktime	7.1.3	Yes
Application	apple	quicktime	7.1.4	Yes
Application	apple	quicktime	7.1.5	Yes
Application	apple	quicktime	7.1.6	Yes
Application	apple	quicktime	7.2	Yes
Application	apple	quicktime	7.2.0	Yes
Application	apple	quicktime	7.2.1	Yes
Application	apple	quicktime	7.3	Yes
Application	apple	quicktime	7.3.0	Yes
Application	apple	quicktime	7.3.1	Yes
Application	apple	quicktime	7.3.1.70	Yes
Application	apple	quicktime	7.4	Yes
Application	apple	quicktime	7.4.0	Yes
Application	apple	quicktime	7.4.1	Yes
Application	apple	quicktime	7.4.5	Yes
Application	apple	quicktime	7.5.0	Yes
Application	apple	quicktime	7.5.5	Yes
Application	apple	quicktime	7.6.0	Yes
Application	apple	quicktime	7.6.1	Yes
Application	apple	quicktime	7.6.2	Yes
Application	apple	quicktime	7.6.5	Yes
Application	apple	quicktime	7.6.6	Yes
Application	apple	quicktime	7.6.7	Yes

References

http://lists.apple.com/archives/security-announce/2010/Sep/msg00003.html Vendor Advisory ([email protected])
http://reversemode.com/index.php?option=com_content&task=view&id=69&Itemid=1 Exploit, Permissions Required ([email protected])
http://support.apple.com/kb/ht4339 Vendor Advisory ([email protected])
http://threatpost.com/en_us/blogs/new-remote-flaw-apple-quicktime-bypasses-aslr-and-dep-083010 Broken Link, Not Applicable ([email protected])
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7523 ([email protected])
https://www.metasploit.com/redmine/projects/framework/repository/entry/modules/exploits/windows/browser/apple_quicktime_marshaled_punk.rb Broken Link, Not Applicable ([email protected])
http://lists.apple.com/archives/security-announce/2010/Sep/msg00003.html Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://reversemode.com/index.php?option=com_content&task=view&id=69&Itemid=1 Exploit, Permissions Required (af854a3a-2127-422b-91ae-364da2661108)
http://support.apple.com/kb/ht4339 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://threatpost.com/en_us/blogs/new-remote-flaw-apple-quicktime-bypasses-aslr-and-dep-083010 Broken Link, Not Applicable (af854a3a-2127-422b-91ae-364da2661108)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7523 (af854a3a-2127-422b-91ae-364da2661108)
https://www.metasploit.com/redmine/projects/framework/repository/entry/modules/exploits/windows/browser/apple_quicktime_marshaled_punk.rb Broken Link, Not Applicable (af854a3a-2127-422b-91ae-364da2661108)