CVE-2007-2397

QuickTime for Java in Apple Quicktime before 7.2 does not properly check permissions, which allows remote attackers to disable security controls and execute arbitrary code via crafted Java applets.

CVSS v2.0 9.3 HIGH

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://docs.info.apple.com/article.html?artnum=305947	Patch
http://lists.apple.com/archives/Security-announce/2007/Jul/msg00001.html	Patch
http://osvdb.org/36132
http://secunia.com/advisories/26034	Patch Vendor Advisory
http://www.securityfocus.com/bid/24873
http://www.securitytracker.com/id?1018373
http://www.us-cert.gov/cas/techalerts/TA07-193A.html	US Government Resource
http://www.vupen.com/english/advisories/2007/2510
https://exchange.xforce.ibmcloud.com/vulnerabilities/35358

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apple:quicktime:-:::::::*
	cpe:2.3:a:apple:quicktime:7.0:::::::*
	cpe:2.3:a:apple:quicktime:7.0.1:::::::*
	cpe:2.3:a:apple:quicktime:7.0.2:::::::*
	cpe:2.3:a:apple:quicktime:7.0.3:::::::*
	cpe:2.3:a:apple:quicktime:7.0.4:::::::*
	cpe:2.3:a:apple:quicktime:7.1:::::::*
	cpe:2.3:a:apple:quicktime:7.1.1:::::::*
	cpe:2.3:a:apple:quicktime:7.1.2:::::::*
	cpe:2.3:a:apple:quicktime:7.1.3:::::::*
	cpe:2.3:a:apple:quicktime:7.1.4:::::::*
	cpe:2.3:a:apple:quicktime:7.1.5:::::::*

History

No history.

Information

Published : 2007-07-15 21:30

Updated : 2018-10-30 16:25

NVD link : CVE-2007-2397

Mitre link : CVE-2007-2397

CVE.ORG link : CVE-2007-2397

JSON object : View

Products Affected

apple

quicktime

CWE

NVD-CWE-Other

{"id": "CVE-2007-2397", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": true, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2007-07-15T21:30:00.000", "references": [{"url": "http://docs.info.apple.com/article.html?artnum=305947", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://lists.apple.com/archives/Security-announce/2007/Jul/msg00001.html", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://osvdb.org/36132", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/26034", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/24873", "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id?1018373", "source": "cve@mitre.org"}, {"url": "http://www.us-cert.gov/cas/techalerts/TA07-193A.html", "tags": ["US Government Resource"], "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2007/2510", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35358", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "QuickTime for Java in Apple Quicktime before 7.2 does not properly check permissions, which allows remote attackers to disable security controls and execute arbitrary code via crafted Java applets."}, {"lang": "es", "value": "QuickTime para Java en Apple Quicktime versiones anteriores a 7.2 no comprueba los permisos apropiadamente, lo cual permite a atacantes remotos deshabilitar controles de seguridad y ejecutar c\u00f3digo de su elecci\u00f3n mediante applets Java manipulados."}], "lastModified": "2018-10-30T16:25:17.590", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apple:quicktime:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1EE08FAE-0862-4C36-95BC-878B04CBF397"}, {"criteria": "cpe:2.3:a:apple:quicktime:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F075BA0F-4A96-4F25-AF1D-C64C7DCE1CDC"}, {"criteria": "cpe:2.3:a:apple:quicktime:7.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8692B488-129A-49EA-AF84-6077FCDBB898"}, {"criteria": "cpe:2.3:a:apple:quicktime:7.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1758610B-3789-489E-A751-386D605E5A08"}, {"criteria": "cpe:2.3:a:apple:quicktime:7.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B535737C-BF32-471C-B26A-588632FCC427"}, {"criteria": "cpe:2.3:a:apple:quicktime:7.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DF2C61F8-B376-40F9-8677-CADCC3295915"}, {"criteria": "cpe:2.3:a:apple:quicktime:7.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6254BB56-5A25-49DC-A851-3CCA249BD71D"}, {"criteria": "cpe:2.3:a:apple:quicktime:7.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "795E3354-7824-4EF4-A788-3CFEB75734E4"}, {"criteria": "cpe:2.3:a:apple:quicktime:7.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9419A1E9-A0DA-4846-8959-BE50B53736E5"}, {"criteria": "cpe:2.3:a:apple:quicktime:7.1.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "952A8015-B18B-481C-AC17-60F0D7EEE085"}, {"criteria": "cpe:2.3:a:apple:quicktime:7.1.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3E518B27-A79B-43A4-AFA6-E59EF8E944D3"}, {"criteria": "cpe:2.3:a:apple:quicktime:7.1.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AEC6EF36-93B3-49BB-9A6F-1990E3F4170E"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}