bugtraq - Re: Buffer-overflow in Quicktime Player 7.3.1.70

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <ABA31EAA-7393-4EC9-93F9-9823DF22F08D@openssl.it>
Date: Sat, 12 Jan 2008 23:41:57 +0100
From: "Marcello Barnaba (void)" <vjt@...nssl.it>
To: bugtraq@...urityfocus.com
Subject: Re: Buffer-overflow in Quicktime Player 7.3.1.70

On Jan 11, 2008, at 10:14 PM, Luigi Auriemma wrote:

 > Now talking about you, Marcello, the problem you had is just with  
"your"
 > same computer/network, probably you have a firewall or something  
else (a
 > "condition" as you define it) that simply makes your ports to appear
 > filtered/timedout and so Quicktime gives up.

Yeah, you are right. Protocol switching was disabled in my Quicktime
preferences. Sorry about that.. I should have checked before writing
inaccurate statements here.

By the way, even with "Transport setup" -> "Automatic", the software
doesn't crash nor loops after reading the HTTP payload, but I really
don't know why.. It merely sits there, saying "Swiching transports".

Attached a full pcap dump of the session and QuickTime.app's version
plist.

Have fun! :)

Marcello

Download attachment "version.plist" of type "application/octet-stream" (510 bytes)

Download attachment "dump.pcap.gz" of type "application/x-gzip" (521 bytes)

-- 
pub 1024D/8D2787EF  723C 7CA3 3C19 2ACE  6E20 9CC1 9956 EB3C 8D27 87EF