Mac OS X is prone to an overflow condition. The QuickTime component fails to properly sanitize user-supplied input when handling rdrf atoms in movie files resulting in a single byte buffer overflow. With a specially crafted movie file, a context-dependent attacker can potentially cause arbitrary code execution.

Upgrade to version 10.7.3 or higher, as it has been reported to fix this vulnerability. In addition, Apple has released a patch for some older versions.

• Security Tracker: 1026627
• CVE ID: 2011-3459 (see also: NVD)
• Secunia Advisory ID: 47843
• Related OSVDB ID: 78802 78803 78804 78805 78806 78807 78808 78809 78810 78811 78813 78814 78815
• Mail List Post: http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html
  http://lists.apple.com/archives/security-announce/2012/May/msg00005.html
• Vendor Specific Advisory URL: http://support.apple.com/kb/HT5130
• Vendor Specific News/Changelog Entry: http://support.apple.com/kb/HT5261
• Vendor URL: http://www.apple.com/
• Other Advisory URL: http://www.zerodayinitiative.com/advisories/ZDI-12-103/

• Luigi Auriemma - Zero Day Initiative (ZDI)