bugtraq - Apple QuickTime udta ATOM Integer Overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <d65cd4390703060057r3443618fie060a0b39e5a69ad@mail.gmail.com>
Date: Tue, 6 Mar 2007 00:57:08 -0800
From: Sowhat <smaillist@...il.com>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: Apple QuickTime udta ATOM Integer Overflow

Apple QuickTime udta ATOM Integer Overflow

By Sowhat of Nevis Labs
Date: 2007.03.06

http://www.nevisnetworks.com
http://secway.org/advisory/AD20070306.txt
http://secway.org/advisory/AD20060512.txt

CVE:	CVE-2007-0714

Vendor:
Apple Inc.

Affected Versions:
Apple QuickTime versions < 7.1.5

Overview:
We have discovered a critical vulnerability in Quicktime Player.
The vulnerability allows an attacker to  execute arbitrary code
in the context of the user who executes QuickTime.

This vulnerability can be exploited By persuading a user to open
a carefully crafted .mov files or visit a website embedding the
malicious .mov file.

The CVE-2006-1460 does not patch the root cause of this vulnerability.

Details:
This vulnerability exists in the way Quicktime process the "udta" Atom of
the .mov files.

The layout of a udta(user data atom) atom:

                           Bytes
   _______________________											
  |    User data atom     |
  |     Atom size         | 4
  |    Type = 'udta'      | 4
  |                       |
  |   User data list      |
  |     Atom size         | 4
  | Type = user data types| 4
  |                       |
   -----------------------

By setting the value of the Atom size to a large value such as 0xFFFFFFFF,
an insufficiently-sized heap block will be allocated, and resulting in a
classic complete heap memory overwrite during the RtlAllocateHeap() function.

Vendor Response:

2006.05.06	Vendor notified via product-security@...le.com
2006.05.07	Vendor responded
2006.05.09	Vendor ask for more information
2006.05.11	Vendor released QuickTime 7.1, the code path was
influenced, but the root cause was not fixed.
2007.03.06	Vendor released the fixed version
2007.03.06	Advisory release

Reference:
1. http://developer.apple.com/documentation/QuickTime/QTFF/index.html
2. http://docs.info.apple.com/article.html?artnum=305149
3. http://secway.org/advisory/AD20060512.txt

-- 
Sowhat
http://secway.org
"Life is like a bug, Do you know how to exploit it ?"