CVE-2008-1585

Published: Jun 10, 2008Modified: Apr 23, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Apple QuickTime before 7.5 uses the url.dll!FileProtocolHandler handler for unrecognized URIs in qt:next attributes within SMIL text in video files, which sends these URIs to explorer.exe and thereby allows remote attackers to execute arbitrary programs, as originally demonstrated by crafted file: URLs.

Affected (1)

Products: Apple: Quicktime

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apple Quicktime	Up to 7.4.5

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (30)

http://lists.apple.com/archives/security-announce/2008//Jul/msg00000.html

Source: cve@mitre.org

http://lists.apple.com/archives/security-announce/2008/Jun/msg00000.html

Source: cve@mitre.org

Patch

http://secunia.com/advisories/29293

Source: cve@mitre.org

http://secunia.com/advisories/31034

Source: cve@mitre.org

http://support.apple.com/kb/HT1991

Source: cve@mitre.org

http://www.kb.cert.org/vuls/id/132419

Source: cve@mitre.org

US Government Resource

http://www.securityfocus.com/archive/1/493248/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/29619

Source: cve@mitre.org

http://www.securityfocus.com/bid/29650

Source: cve@mitre.org

http://www.securitytracker.com/id?1020217

Source: cve@mitre.org

http://www.us-cert.gov/cas/techalerts/TA08-162C.html

Source: cve@mitre.org

US Government Resource

http://www.vupen.com/english/advisories/2008/1776/references

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/2064/references

Source: cve@mitre.org

http://www.zerodayinitiative.com/advisories/ZDI-08-038/

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/42948

Source: cve@mitre.org

http://lists.apple.com/archives/security-announce/2008//Jul/msg00000.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.apple.com/archives/security-announce/2008/Jun/msg00000.html

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://secunia.com/advisories/29293

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/31034

Source: af854a3a-2127-422b-91ae-364da2661108

http://support.apple.com/kb/HT1991

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.kb.cert.org/vuls/id/132419

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.securityfocus.com/archive/1/493248/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/29619

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/29650

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1020217

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.us-cert.gov/cas/techalerts/TA08-162C.html

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.vupen.com/english/advisories/2008/1776/references

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2008/2064/references

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.zerodayinitiative.com/advisories/ZDI-08-038/

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/42948

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.