SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Multimedia)  >   Apple QuickTime Vendors:   Apple
Apple QuickTime Player Integer and Buffer Overflows Let Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1015152
SecurityTracker URL:  http://securitytracker.com/id/1015152
CVE Reference:   CVE-2005-2753, CVE-2005-2754, CVE-2005-2755, CVE-2005-2756   (Links to External Site)
Date:  Nov 4 2005
Impact:   Denial of service via network, Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 6.5.2 for Mac OS X, 7.0.1 for Mac OS X, 7* for Windows (prior to 7.0.3)
Description:   Several vulnerabilities were reported in Apple QuickTime Player. A remote user can cause arbitrary code to be executed on the target user's system.

A remote user can create a specially crafted file that, when loaded by the target user, will cause the player to crash or to execute arbitrary code on the target user's system.

The player contains an integer overflow in the processing of MOV video files. A sign extension of an embedded "Pascal" style string can trigger one overflow [CVE-2005-2753]. Invalid movie attributes can trigger another overflow [CVE-2005-2754].

The player does not properly process movies with a missing movie attribute, triggering a NULL pointer dereference and causing the player to crash [CVE-2005-2755].

The Apple QuickTime PictureViewer contains a buffer overflow in the expansion of compressed PICT data [CVE-2005-2756].

Piotr Bania discovered these vulnerabilities.

The original advisories are available at:

http://pb.specialised.info/all/adv/quicktime-mov-io1-adv.txt
http://pb.specialised.info/all/adv/quicktime-mov-io2-adv.txt
http://pb.specialised.info/all/adv/quicktime-mov-dos-adv.txt
http://pb.specialised.info/all/adv/quicktime-pict-adv.txt

Impact:   A remote user can create a file that, when processed by the target user, will execute arbitrary code on the target user's system. The code will run with the privileges of the target user.
Solution:   The vendor has issued a fixed version (7.0.3), available via Software Update preferences, or from Apple Downloads at:

http://www.apple.com/support/downloads/

The vendor's advisory is available at:

http://docs.info.apple.com/article.html?artnum=302772

Vendor URL:  docs.info.apple.com/article.html?artnum=302772 (Links to External Site)
Cause:   Boundary error
Underlying OS:  UNIX (macOS/OS X), Windows (2000), Windows (XP)

Message History:   None.


 Source Message Contents

Subject:  [Full-disclosure] Advisory: Apple QuickTime Player Remote Integer



Apple QuickTime Player Remote Integer Overflow (1)
by Piotr Bania <bania.piotr@gmail.com>
http://pb.specialised.info
All rights reserved.


CVE-ID: 		CVE-2005-2753

Original location:
http://pb.specialised.info/all/adv/quicktime-mov-io1-adv.txt

Severity: 		Critical - remote code execution.

Software affected:	QuickTime package 7.0.1 for Mac OS X 10.3
			QuickTime package 7.0.1 for Mac OS X 10.4
			QuickTime package 6.5.2 for Mac OS X 10.3
			QuickTime package 6.5.2 for Mac OS X 10.2
			QuickTime package 7* for Windows

			Older versions may be also vulnerable.
Note:			Following versions are not vulnerable, due to
			the fact I have reported the vulnerabilities
			before their releases:

			QuickTime package 7.0.2 for Mac OS X 10.3
			QuickTime package 7.0.2 for Mac OS X 10.4



0.   DISCLAIMER

Author takes no responsibility for any actions with provided
informations or codes. The copyright for any material created by the
author is reserved. Any duplication of codes or texts provided here in
electronic or printed publications is not permitted without the author's
agreement.

I.   BACKGROUND

Apple QuickTime Player is one of the Apple QuickTime components
used by hundreds of millions of users.

II.  DESCRIPTION

Apple QuickTime Player is reported prone to remote integer overflow
vulnerability (exploitable via remotely originated content).

A sign extension of an embedded "Pascal" style string could result in
a very large memory copy, which lead to potencial memory overwrite.

The vulnerability may lead to remote code execution when specially
crafted video file (MOV file) is being loaded.

III. POC CODE

Due to severity of this bug i will not release any proof of concept
codes for this issue.

IV.  VENDOR RESPONSE

Vendor (Apple) has been noticed and released all necessary patches.


best regards,
Piotr Bania

-- 
--------------------------------------------------------------------
Piotr Bania - <bania.piotr@gmail.com> - 0xCD, 0x19
Fingerprint: 413E 51C7 912E 3D4E A62A  BFA4 1FF6 689F BE43 AC33
http://pb.specialised.info  - Key ID: 0xBE43AC33
--------------------------------------------------------------------

                           " Dinanzi a me non fuor cose create
                             se non etterne, e io etterno duro.
                             Lasciate ogne speranza, voi ch'intrate "
                                           - Dante, Inferno Canto III

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC