Message-ID: <3E88911B.5891.23C5D73@localhost>
Date: Mon, 31 Mar 2003 19:03:55 -0500
From: "iDEFENSE Labs" <labs@...fense.com>
To: bugtraq@...urityfocus.com
Subject: iDEFENSE Security Advisory 03.31.03: Buffer Overflow in Windows QuickTime Player


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

iDEFENSE Security Advisory 03.31.03:
http://www.idefense.com/advisory/03.31.03.txt
Buffer Overflow in Windows QuickTime Player
March 31, 2003

I. BACKGROUND

QuickTime Player is a popular media player for both the Microsoft Windows
and Apple Mac platforms.  More information about the application is
available at http://www.apple.com/quicktime/ . 

II. DESCRIPTION

An exploitable buffer overflow condition has been discovered in Apple
Computer Inc.'s QuickTime Player, allowing for the remote execution of
arbitrary code. The vulnerability lies in the processing of long QuickTime
URL's (quicktime:// or through the -u switch). When processing a QuickTime
URL, the application is launched in the following manner as can be seen
from the Windows registry key HKEY_CLASSES_ROOT/quicktime: 

%PATH TO QUICKTIME%\QuickTimePlayer.exe -u"%1" 

A URL containing 400 characters will overrun the allocated space on the
stack overwriting the saved instruction pointer (EIP). This will thereby
allow an attacker to redirect the flow of control. An example URL that
will cause QuickTime player to crash is: 

quicktime://127.0.0.1/AAAA... 

Where the character 'A' is repeated 400 times.

III. ANALYSIS

Any remote attacker can compromise a target system if he or she can
convince a user to load a specially crafted exploit URL.  Upon successful
exploitation, arbitrary code can be executed under the privileges of the
user who launched QuickTime.  

IV. DETECTION

iDEFENSE has confirmed that QuickTime Player versions 5.x and 6.0 for the
Microsoft Windows platform are vulnerable. QuickTime for MacOS is not
vulnerable.

V. WORKAROUND

Removing the QuickTime handler from the web browser or removing the
registry key HKEY_CLASSES_ROOT/quicktime can prevent automatic
exploitation through HTML pages.

VI. VENDOR FIX

Apple has released QuickTime 6.1 which addresses this vulnerability.  It
is available from http://www.apple.com/quicktime/download/ .

VII. CVE INFORMATION

The Mitre Corp.'s Common Vulnerabilities and Exposures (CVE) Project
assigned the identification number CAN-2003-0168 to this issue.

VIII. DISCLOSURE TIMELINE

01/16/2003	Issue disclosed to iDEFENSE
02/24/2003	iDEFENSE notification sent to product-security@...le.com
02/24/2003	Response received from Apple Product Security team
02/24/2003	iDEFENSE clients notified
03/31/2003	Coordinated Public disclosure 

IX. CREDIT

Texonet (http://www.texonet.com) is credited with discovering this
vulnerability.


Get paid for security research
http://www.idefense.com/contributor.html

Subscribe to iDEFENSE Advisories:
send email to listserv@...fense.com, subject line: "subscribe"


About iDEFENSE:

iDEFENSE is a global security intelligence company that proactively
monitors sources throughout the world — from technical
vulnerabilities and hacker profiling to the global spread of viruses
and other malicious code. Our security intelligence services provide 
decision-makers, frontline security professionals and network 
administrators with timely access to actionable intelligence
and decision support on cyber-related threats. For more information,
visit http://www.idefense.com .

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0

iQA/AwUBPojWxvrkky7kqW5PEQKpugCfR7CiM+8599fwqY/2T0CyUqAMhGUAn0ZX
Zi9OhMExCYJAdDPZdzn1JKgc
=VDX8
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists