CVE-2007-2393

The design of QuickTime for Java in Apple Quicktime before 7.2 allows remote attackers to bypass certain security controls and write to process memory via Java applets, possibly leading to arbitrary code execution.

CVSS v2.0 9.3 HIGH

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://docs.info.apple.com/article.html?artnum=305947	Patch
http://lists.apple.com/archives/Security-announce/2007/Jul/msg00001.html	Patch
http://osvdb.org/36135
http://secunia.com/advisories/26034	Patch Vendor Advisory
http://www.securityfocus.com/bid/24873
http://www.securitytracker.com/id?1018373
http://www.us-cert.gov/cas/techalerts/TA07-193A.html	US Government Resource
http://www.vupen.com/english/advisories/2007/2510
https://exchange.xforce.ibmcloud.com/vulnerabilities/35359

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apple:quicktime:-:::::::*
	cpe:2.3:a:apple:quicktime:7.0:::::::*
	cpe:2.3:a:apple:quicktime:7.0.1:::::::*
	cpe:2.3:a:apple:quicktime:7.0.2:::::::*
	cpe:2.3:a:apple:quicktime:7.0.3:::::::*
	cpe:2.3:a:apple:quicktime:7.0.4:::::::*
	cpe:2.3:a:apple:quicktime:7.1:::::::*
	cpe:2.3:a:apple:quicktime:7.1.1:::::::*
	cpe:2.3:a:apple:quicktime:7.1.2:::::::*
	cpe:2.3:a:apple:quicktime:7.1.3:::::::*
	cpe:2.3:a:apple:quicktime:7.1.4:::::::*
	cpe:2.3:a:apple:quicktime:7.1.5:::::::*

History

No history.

Information

Published : 2007-07-15 21:30

Updated : 2018-10-30 16:25

NVD link : CVE-2007-2393

Mitre link : CVE-2007-2393

CVE.ORG link : CVE-2007-2393

JSON object : View

Products Affected

apple

quicktime

CWE

NVD-CWE-Other

{"id": "CVE-2007-2393", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": true, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2007-07-15T21:30:00.000", "references": [{"url": "http://docs.info.apple.com/article.html?artnum=305947", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://lists.apple.com/archives/Security-announce/2007/Jul/msg00001.html", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://osvdb.org/36135", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/26034", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/24873", "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id?1018373", "source": "cve@mitre.org"}, {"url": "http://www.us-cert.gov/cas/techalerts/TA07-193A.html", "tags": ["US Government Resource"], "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2007/2510", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35359", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "The design of QuickTime for Java in Apple Quicktime before 7.2 allows remote attackers to bypass certain security controls and write to process memory via Java applets, possibly leading to arbitrary code execution."}, {"lang": "es", "value": "El dise\u00f1o del QuickTime para Java en el Apple Quicktime anterior al 7.2 permite a atacantes remotos evitar ciertos controles de seguridad y escribir en procesos de memoria a trav\u00e9s de applets de Java, posiblemente conllevando una ejecuci\u00f3n de c\u00f3digo de su elecci\u00f3n."}], "lastModified": "2018-10-30T16:25:17.590", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apple:quicktime:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1EE08FAE-0862-4C36-95BC-878B04CBF397"}, {"criteria": "cpe:2.3:a:apple:quicktime:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F075BA0F-4A96-4F25-AF1D-C64C7DCE1CDC"}, {"criteria": "cpe:2.3:a:apple:quicktime:7.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8692B488-129A-49EA-AF84-6077FCDBB898"}, {"criteria": "cpe:2.3:a:apple:quicktime:7.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1758610B-3789-489E-A751-386D605E5A08"}, {"criteria": "cpe:2.3:a:apple:quicktime:7.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B535737C-BF32-471C-B26A-588632FCC427"}, {"criteria": "cpe:2.3:a:apple:quicktime:7.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DF2C61F8-B376-40F9-8677-CADCC3295915"}, {"criteria": "cpe:2.3:a:apple:quicktime:7.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6254BB56-5A25-49DC-A851-3CCA249BD71D"}, {"criteria": "cpe:2.3:a:apple:quicktime:7.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "795E3354-7824-4EF4-A788-3CFEB75734E4"}, {"criteria": "cpe:2.3:a:apple:quicktime:7.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9419A1E9-A0DA-4846-8959-BE50B53736E5"}, {"criteria": "cpe:2.3:a:apple:quicktime:7.1.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "952A8015-B18B-481C-AC17-60F0D7EEE085"}, {"criteria": "cpe:2.3:a:apple:quicktime:7.1.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3E518B27-A79B-43A4-AFA6-E59EF8E944D3"}, {"criteria": "cpe:2.3:a:apple:quicktime:7.1.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AEC6EF36-93B3-49BB-9A6F-1990E3F4170E"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}