CVE-2007-2175 - Vulnerability Details - OpenCVE

Apple QuickTime Java extensions (QTJava.dll), as used in Safari and other browsers, and when Java is enabled, allows remote attackers to execute arbitrary code via parameters to the toQTPointer method in quicktime.util.QTHandleRef, which can be used to modify arbitrary memory when creating QTPointerRef objects, as demonstrated during the "PWN 2 0WN" contest at CanSecWest 2007.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity High

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Apple	Safari

Configuration 1 [-]

cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://cansecwest.com/post/2007-04-20-14:54:00.First_Mac_Hacked_Cancel_Or_Allow
http://docs.info.apple.com/article.html?artnum=305446
http://lists.apple.com/archives/security-announce/2007/May/msg00001.html
http://www.kb.cert.org/vuls/id/420668
http://www.matasano.com/log/806/hot-off-the-matasano-sms-queue-cansec-macbook-challenge-won/
http://www.matasano.com/log/812/breaking-macbook-vuln-in-quicktime-affects-win32-apple-code/
http://www.osvdb.org/34178
http://www.securityfocus.com/archive/1/467319/100/0/threaded
http://www.securitytracker.com/id?1017950
http://www.theregister.co.uk/2007/04/20/pwn-2-own_winner/
http://www.zerodayinitiative.com/advisories/ZDI-07-023.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/33827

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-04-24T16:00:00

Updated: 2024-08-07T13:23:50.887Z

Reserved: 2007-04-24T00:00:00

Link: CVE-2007-2175

Vulnrichment

No data.

NVD

Status : Modified

Published: 2007-04-24T16:19:00.000

Modified: 2024-11-21T00:30:06.110

Link: CVE-2007-2175

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-04-22T00:00:00", "descriptions": [{"lang": "en", "value": "Apple QuickTime Java extensions (QTJava.dll), as used in Safari and other browsers, and when Java is enabled, allows remote attackers to execute arbitrary code via parameters to the toQTPointer method in quicktime.util.QTHandleRef, which can be used to modify arbitrary memory when creating QTPointerRef objects, as demonstrated during the \"PWN 2 0WN\" contest at CanSecWest 2007."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-16T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://www.zerodayinitiative.com/advisories/ZDI-07-023.html"}, {"tags": ["x_refsource_MISC"], "url": "http://cansecwest.com/post/2007-04-20-14:54:00.First_Mac_Hacked_Cancel_Or_Allow"}, {"name": "quicktime-unspecified-code-execution(33827)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33827"}, {"name": "1017950", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id?1017950"}, {"name": "APPLE-SA-2007-05-01", "tags": ["vendor-advisory", "x_refsource_APPLE"], "url": "http://lists.apple.com/archives/security-announce/2007/May/msg00001.html"}, {"tags": ["x_refsource_MISC"], "url": "http://www.theregister.co.uk/2007/04/20/pwn-2-own_winner/"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://docs.info.apple.com/article.html?artnum=305446"}, {"name": "20070501 ZDI-07-023: Apple QTJava toQTPointer() Pointer Arithmetic Memory Overwrite Vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/467319/100/0/threaded"}, {"tags": ["x_refsource_MISC"], "url": "http://www.matasano.com/log/806/hot-off-the-matasano-sms-queue-cansec-macbook-challenge-won/"}, {"name": "34178", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/34178"}, {"name": "VU#420668", "tags": ["third-party-advisory", "x_refsource_CERT-VN"], "url": "http://www.kb.cert.org/vuls/id/420668"}, {"tags": ["x_refsource_MISC"], "url": "http://www.matasano.com/log/812/breaking-macbook-vuln-in-quicktime-affects-win32-apple-code/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-2175", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Apple QuickTime Java extensions (QTJava.dll), as used in Safari and other browsers, and when Java is enabled, allows remote attackers to execute arbitrary code via parameters to the toQTPointer method in quicktime.util.QTHandleRef, which can be used to modify arbitrary memory when creating QTPointerRef objects, as demonstrated during the \"PWN 2 0WN\" contest at CanSecWest 2007."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://www.zerodayinitiative.com/advisories/ZDI-07-023.html", "refsource": "MISC", "url": "http://www.zerodayinitiative.com/advisories/ZDI-07-023.html"}, {"name": "http://cansecwest.com/post/2007-04-20-14:54:00.First_Mac_Hacked_Cancel_Or_Allow", "refsource": "MISC", "url": "http://cansecwest.com/post/2007-04-20-14:54:00.First_Mac_Hacked_Cancel_Or_Allow"}, {"name": "quicktime-unspecified-code-execution(33827)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33827"}, {"name": "1017950", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id?1017950"}, {"name": "APPLE-SA-2007-05-01", "refsource": "APPLE", "url": "http://lists.apple.com/archives/security-announce/2007/May/msg00001.html"}, {"name": "http://www.theregister.co.uk/2007/04/20/pwn-2-own_winner/", "refsource": "MISC", "url": "http://www.theregister.co.uk/2007/04/20/pwn-2-own_winner/"}, {"name": "http://docs.info.apple.com/article.html?artnum=305446", "refsource": "CONFIRM", "url": "http://docs.info.apple.com/article.html?artnum=305446"}, {"name": "20070501 ZDI-07-023: Apple QTJava toQTPointer() Pointer Arithmetic Memory Overwrite Vulnerability", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/467319/100/0/threaded"}, {"name": "http://www.matasano.com/log/806/hot-off-the-matasano-sms-queue-cansec-macbook-challenge-won/", "refsource": "MISC", "url": "http://www.matasano.com/log/806/hot-off-the-matasano-sms-queue-cansec-macbook-challenge-won/"}, {"name": "34178", "refsource": "OSVDB", "url": "http://www.osvdb.org/34178"}, {"name": "VU#420668", "refsource": "CERT-VN", "url": "http://www.kb.cert.org/vuls/id/420668"}, {"name": "http://www.matasano.com/log/812/breaking-macbook-vuln-in-quicktime-affects-win32-apple-code/", "refsource": "MISC", "url": "http://www.matasano.com/log/812/breaking-macbook-vuln-in-quicktime-affects-win32-apple-code/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T13:23:50.887Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.zerodayinitiative.com/advisories/ZDI-07-023.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://cansecwest.com/post/2007-04-20-14:54:00.First_Mac_Hacked_Cancel_Or_Allow"}, {"name": "quicktime-unspecified-code-execution(33827)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33827"}, {"name": "1017950", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id?1017950"}, {"name": "APPLE-SA-2007-05-01", "tags": ["vendor-advisory", "x_refsource_APPLE", "x_transferred"], "url": "http://lists.apple.com/archives/security-announce/2007/May/msg00001.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.theregister.co.uk/2007/04/20/pwn-2-own_winner/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://docs.info.apple.com/article.html?artnum=305446"}, {"name": "20070501 ZDI-07-023: Apple QTJava toQTPointer() Pointer Arithmetic Memory Overwrite Vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/467319/100/0/threaded"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.matasano.com/log/806/hot-off-the-matasano-sms-queue-cansec-macbook-challenge-won/"}, {"name": "34178", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/34178"}, {"name": "VU#420668", "tags": ["third-party-advisory", "x_refsource_CERT-VN", "x_transferred"], "url": "http://www.kb.cert.org/vuls/id/420668"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.matasano.com/log/812/breaking-macbook-vuln-in-quicktime-affects-win32-apple-code/"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-2175", "datePublished": "2007-04-24T16:00:00", "dateReserved": "2007-04-24T00:00:00", "dateUpdated": "2024-08-07T13:23:50.887Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*", "matchCriteriaId": "AE370CAA-04B3-434E-BD5B-1D87DE596C10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Apple QuickTime Java extensions (QTJava.dll), as used in Safari and other browsers, and when Java is enabled, allows remote attackers to execute arbitrary code via parameters to the toQTPointer method in quicktime.util.QTHandleRef, which can be used to modify arbitrary memory when creating QTPointerRef objects, as demonstrated during the \"PWN 2 0WN\" contest at CanSecWest 2007."}, {"lang": "es", "value": "Las extensiones de Apple QuickTime Java (en la biblioteca QTJava .dll), como es usado en Safari y otros navegadores, y cuando Java est\u00e1 habilitado, permiten que los atacantes remotos ejecuten c\u00f3digo arbitrario por medio de par\u00e1metros hacia el m\u00e9todo toQTPointer en quicktime.util.QTHandleRef, que puede ser usado para modificar memoria arbitraria al crear objetos QTPointerRef, como se demostr\u00f3 durante el concurso \"PWN 2 0WN\" en CanSecWest 2007"}], "id": "CVE-2007-2175", "lastModified": "2024-11-21T00:30:06.110", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.6, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 4.9, "impactScore": 10.0, "obtainAllPrivilege": true, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2007-04-24T16:19:00.000", "references": [{"source": "cve@mitre.org", "url": "http://cansecwest.com/post/2007-04-20-14:54:00.First_Mac_Hacked_Cancel_Or_Allow"}, {"source": "cve@mitre.org", "url": "http://docs.info.apple.com/article.html?artnum=305446"}, {"source": "cve@mitre.org", "url": "http://lists.apple.com/archives/security-announce/2007/May/msg00001.html"}, {"source": "cve@mitre.org", "tags": ["US Government Resource"], "url": "http://www.kb.cert.org/vuls/id/420668"}, {"source": "cve@mitre.org", "url": "http://www.matasano.com/log/806/hot-off-the-matasano-sms-queue-cansec-macbook-challenge-won/"}, {"source": "cve@mitre.org", "url": "http://www.matasano.com/log/812/breaking-macbook-vuln-in-quicktime-affects-win32-apple-code/"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/34178"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/467319/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securitytracker.com/id?1017950"}, {"source": "cve@mitre.org", "url": "http://www.theregister.co.uk/2007/04/20/pwn-2-own_winner/"}, {"source": "cve@mitre.org", "url": "http://www.zerodayinitiative.com/advisories/ZDI-07-023.html"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33827"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://cansecwest.com/post/2007-04-20-14:54:00.First_Mac_Hacked_Cancel_Or_Allow"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://docs.info.apple.com/article.html?artnum=305446"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.apple.com/archives/security-announce/2007/May/msg00001.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["US Government Resource"], "url": "http://www.kb.cert.org/vuls/id/420668"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.matasano.com/log/806/hot-off-the-matasano-sms-queue-cansec-macbook-challenge-won/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.matasano.com/log/812/breaking-macbook-vuln-in-quicktime-affects-win32-apple-code/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/34178"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/467319/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id?1017950"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.theregister.co.uk/2007/04/20/pwn-2-own_winner/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.zerodayinitiative.com/advisories/ZDI-07-023.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33827"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}