bugtraq - Still beginner's errors (and outdated 3rd party components) in QuickTime 7.7.6 and iTunes 12.0.1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 24 Oct 2014 20:03:22 +0200
From: "Stefan Kanthak" <stefan.kanthak@...go.de>
To: <bugtraq@...urityfocus.com>
Cc: <fulldisclosure@...lists.org>
Subject: Still beginner's errors (and outdated 3rd party components) in QuickTime 7.7.6 and iTunes 12.0.1

Hi @ll,

the just released QuickTime 7.7.6 and iTunes 12.0.1 for Windows still
have quite some of the beginners errors I documented in
<http://seclists.org/fulldisclosure/2014/Aug/33> and
<http://seclists.org/fulldisclosure/2014/Aug/44>


QuickTime 7.7.6:

[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Media\QuickTime\shell\open\command]
@="C:\\Program Files\\QuickTime\\QuickTimePlayer.exe"


iTunes 12.0.1:

[HKEY_CLASSES_ROOT\daap\shell\open\command]
@="C:\\Program Files\\...\\iTunes.exe /url \"%1\""

[HKEY_CLASSES_ROOT\itls\shell\open\command]
@="C:\\Program Files\\...\\iTunes.exe /url \"%1\""

[HKEY_CLASSES_ROOT\itms\shell\open\command]
@="C:\\Program Files\\...\\iTunes.exe /url \"%1\""

[HKEY_CLASSES_ROOT\itmss\shell\open\command]
@="C:\\Program Files\\...\\iTunes.exe /url \"%1\""

[HKEY_CLASSES_ROOT\itpc\shell\open\command]
@="C:\\Program Files\\...\\iTunes.exe /url \"%1\""

[HKEY_CLASSES_ROOT\itsradio\shell\open\command]
@="C:\\Program Files\\...\\iTunes.exe /url \"%1\""

[HKEY_CLASSES_ROOT\itunesradio\shell\open\command]
@="C:\\Program Files\\...\\iTunes.exe /url \"%1\""

[HKEY_CLASSES_ROOT\iTunes\shell\open\command]
@="C:\\Program Files\\...\\iTunes.exe /url \"%1\""

[HKEY_CLASSES_ROOT\iTunes.AssocProtocol.daap\shell\open\command]
@="C:\\Program Files\\...\\iTunes.exe /url \"%1\""

[HKEY_CLASSES_ROOT\iTunes.AssocProtocol.itls\shell\open\command]
@="C:\\Program Files\\...\\iTunes.exe /url \"%1\""

[HKEY_CLASSES_ROOT\iTunes.AssocProtocol.itms\shell\open\command]
@="C:\\Program Files\\...\\iTunes.exe /url \"%1\""

[HKEY_CLASSES_ROOT\iTunes.AssocProtocol.itmss\shell\open\command]
@="C:\\Program Files\\...\\iTunes.exe /url \"%1\""

[HKEY_CLASSES_ROOT\iTunes.AssocProtocol.itpc\shell\open\command]
@="C:\\Program Files\\...\\iTunes.exe /url \"%1\""

[HKEY_CLASSES_ROOT\iTunes.AssocProtocol.pcast\shell\open\command]
@="C:\\Program Files\\...\\iTunes.exe /url \"%1\""

[HKEY_CLASSES_ROOT\pcast\shell\open\command]
@="C:\\Program Files\\...\\iTunes.exe /url \"%1\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Media\iTunes\shell\open\command]
@="C:\\Program Files\\...\\iTunes.exe"


Also, QuickTime 7.7.6 comes with version 2.3.6 of Apple's application
support, while iTunes 12.0.1 comes with version 3.1 of this package.

While the older version 2.3.6 properly quotes the command lines in

[HKEY_CLASSES_ROOT\CLSID\{fdd068c2-d51a-4175-8a20-5cbc704ea3bd}\LocalServer32]
@="\"C:\\Program Files\\...\\APSDaemon.exe\""

[HKEY_CLASSES_ROOT\CLSID\{6812639B-FD61-4329-9901-22CFDBD690FE}\LocalServer32]
@="\"C:\\Program Files\\...\\APSDaemon.exe\""

the newer version 3.1 does not:

[HKEY_CLASSES_ROOT\CLSID\{fdd068c2-d51a-4175-8a20-5cbc704ea3bd}\LocalServer32]
@="C:\\Program Files\\...\\APSDaemon.exe"

[HKEY_CLASSES_ROOT\CLSID\{6812639B-FD61-4329-9901-22CFDBD690FE}\LocalServer32]
@="C:\\Program Files\\...\\APSDaemon.exe"

[HKEY_CLASSES_ROOT\CLSID\{D9E904CA-8865-42E7-B0F0-B7B8C4D54D70}\LocalServer32]
@="C:\\Program Files\\...\\APSDaemon.exe"


Additionally, application support 3.1 contains outdated and vulnerable
version 10.0.40219.1 of MSVCR100.DLL and MSVCP100.DLL

Cf. <http://support.microsoft.com/kb/24671743> and
<http://support.microsoft.com/kb/2565063> alias
<http://www.microsoft.com/technet/security/bulletin/ms11-025>


Will Apple's developers and their QA EVER learn how to use filenames
with embedded spaces properly?


regards
Stefan Kanthak