Apple QuickTime (QuickTime.qts) Heap Overflow

Release Date:
May 02, 2004

Date Reported:
February 18, 2004

Severity:
High (Code Execution)

Vendor:
Apple

Systems Affected:
Apple QuickTime 6.5
Apple iTunes 4.2.0.72

Description:
The Apple QuickTime media player is used for playing, interacting with
or viewing video, audio, VR or graphics files.  Many popular web
browsers, media players, and other applications use their libraries to
play various QuickTime movie formats through their applications.

eEye Digital Security has discovered a critical vulnerability in
QuickTime Player. The vulnerability allows a remote attacker to reliably
overwrite heap memory with user-controlled data and execute arbitrary
code within the SYSTEM context.

This specific flaw exists within the QuickTime.qts file which many
applications access QuickTime's functionality through.  By specially
crafting atoms within a movie file, a direct heap overwrite is
triggered, and reliable code execution is then possible.

Technical Details:
The code in QuickTime.qts responsible for copying Sample-to-Chunk table
entries from the 'stsc' atom data in a QuickTime-format movie into an
array allocated on the heap.  According to developer.apple.com, the
format of the Sample-to-Chunk atom is as follows:

  Offset  Type    Description
  ------- ------- --------------------------------
  0000h   DWORD   atom size
  0004h   DWORD   atom type tag ('stsc')
  0008h   BYTE    version
  0009h   BYTE[3] flags
  000Ch   DWORD   number of entries
  0010h   ...     sample-to-chunk table data

The heap block intended to hold the sample-to-chunk table data is
allocated with a size equal to (number_of_entries + 2) * 16.  By
supplying the "number of entries" field with the value 0x0FFFFFFE or
greater, an absolutely classic integer overflow results that causes an
insufficiently-sized heap block to be allocated, resulting in an equally
classic complete heap memory overwrite.

It is difficult to express just how textbook this vulnerability scenario
really is.  Successful exploitation of the vulnerability is
self-evident, and therefore no further discussion is warranted.  It is
our sincere hope that the vendor will make an earnest effort to increase
the maturity of its security response capabilities, so that researchers
will be encouraged to continue to work with them amicably on future
security issues. Apple is doing a disservice to its customers by
incorrectly labeling this vulnerability as a "crash bug" rather than
stating correctly that attackers can compromise systems running the
affected Apple software.

References:
QuickTime: QuickTime File Format
http://developer.apple.com/documentation/QuickTime/QTFF/index.html

Vendor Status:
Apple has released a patch for this vulnerability. The patch is
available via the Updates section of the affected applications.

This vulnerability has been assigned the CVE identifier CAN-2004-0431.

Credit:
Karl Lynn

Additional Research:
Derek Soeder

Greetings:
Riley Hassell, Fuzen, Cubby, the ladies in the band MudBath, Zoe bird,
Michelle L., and of course the entire staff at eEye.

Copyright (c) 1998-2004 eEye Digital Security Permission is hereby
granted for the redistribution of this alert electronically. It is not
to be edited in any way without express consent of eEye. If you wish to
reprint the whole or any part of this alert in any other medium
excluding electronic medium, please email alert@eEye.com for permission.

Disclaimer
The information within this paper may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There
are NO warranties with regard to this information. In no event shall the
author be liable for any damages whatsoever arising out of or in
connection with the use or spread of this information. Any use of this
information is at the user's own risk.

Feedback
Please send suggestions, updates, and comments to:

eEye Digital Security
http://www.eEye.com
info@eEye.com