Arbor Networks: Security to the Core

… and will happen again, to paraphrase BSG: Razor.

A few days ago we started seeing reports of a new 0-day vulnerability in QuickTime 7.3. RTSP “Content-type” header overflow. It’s been about a week and there’s still no CVE ID attached to it. We have countless exploits out against it now. No patch in sight.

And yet we have CVE-2002-0252, which is summarized as a “Buffer overflow in Apple QuickTime Player 5.01 and 5.02 allows remote web servers to execute arbitrary code via a response containing a long Content-Type MIME header.”

Sounds familiar? Was it fixed? Is this a revert? Is this a new bug? I don’t know if conclusive answers have been found to those questions, but I’m sure that someone is looking.

I haven’t seen anything in the wild using this yet, but that’s surprising. I’m expecting to see a few sites popping up with malicious QuickTime content, ready to own.

And now we have a CVE entry CVE-2007-6166, so this looks like a new issue.

This entry was posted on Thursday, November 29th, 2007 at 12:40 pm and is filed under Exploit Code, Vulnerabilities. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.