*****************************
Widely Deployed Software
*****************************
(1) CRITICAL: Apple QuickTime RTSP URL Handler Buffer Overflow
Affected:
QuickTime version 7.1.3 and possibly prior on Mac OS and Windows platforms
Description: Apple QuickTime, a widely used media player, contains a
stack-based buffer overflow in handling RTSP URLs. The overflow has been
discovered by the "Month of Apple Bugs" project, and can be triggered
by a specially crafted RTSP URL that is 300 bytes or longer. A malicious
webpage or a media file can exploit this flaw to execute arbitrary code
on a user's system. Note that systems using QuickTime as the default
media player can be compromised upon browsing to a malicious webpage
without any user interaction. Exploit code has been publicly posted.
Status: Apple has not confirmed, no patches available. A workaround is
to disable the RTSP URL handler.
References:
Month of Apple Bugs
Exploit Code
07.1.15 CVE: Not Available
Platform: Cross Platform
Title: OpenSER OSP Module Validateospheader Function Buffer Overflow
Description: OpenSER is an open source SIP server. The OpenSER OSP
Module is prone to a buffer overflow vulnerability that exists in the
"validateospheader()" function when validating OSP headers. An
attacker may exploit this vulnerability by manipulating the OSP
headers, ultimately resulting in memory corruption. Versions 1.1.0 and
prior are reportedly vulnerable.
Ref:
______________________________________________________________________
