exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

quicktime-mov-io2-adv.txt

quicktime-mov-io2-adv.txt
Posted Nov 4, 2005
Authored by Piotr Bania | Site pb.specialised.info

Apple QuickTime Player is reported prone to remote integer overflow vulnerability (exploitable via remotely originated content). Improper movie attributes could result in a very large memory copy, which lead to potential memory overwrite. The vulnerability may lead to remote code execution when specially crafted video file (MOV file) is being loaded. Software affected: QuickTime package 7.0.1 for Mac OS X 10.3, QuickTime package 7.0.1 for Mac OS X 10.4, QuickTime package 6.5.2 for Mac OS X 10.3, QuickTime package 6.5.2 for Mac OS X 10.2, QuickTime package 7x for Windows.

tags | advisory, remote, overflow, code execution
systems | windows, apple, osx
advisories | CVE-2005-2754
SHA-256 | a7fa09ceb9372c03ccbab0386d3205945a1fd05053debe49950536097f029a4d

quicktime-mov-io2-adv.txt

Change Mirror Download



Apple QuickTime Player Remote Integer Overflow (2)
by Piotr Bania <bania.piotr@gmail.com>
http://pb.specialised.info
All rights reserved.


CVE-ID: CVE-2005-2754

Original location:
http://pb.specialised.info/all/adv/quicktime-mov-io2-adv.txt

Severity: Critical - remote code execution.

Software affected: QuickTime package 7.0.1 for Mac OS X 10.3
QuickTime package 7.0.1 for Mac OS X 10.4
QuickTime package 6.5.2 for Mac OS X 10.3
QuickTime package 6.5.2 for Mac OS X 10.2
QuickTime package 7* for Windows

Older versions may be also vulnerable.
Note: Following versions are not vulnerable, due to
the fact I have reported the vulnerabilities
before their releases:

QuickTime package 7.0.2 for Mac OS X 10.3
QuickTime package 7.0.2 for Mac OS X 10.4



0. DISCLAIMER

Author takes no responsibility for any actions with provided
informations or codes. The copyright for any material created by the
author is reserved. Any duplication of codes or texts provided here in
electronic or printed publications is not permitted without the author's
agreement.

I. BACKGROUND

Apple QuickTime Player is one of the Apple QuickTime components
used by hundreds of millions of users.

II. DESCRIPTION

Apple QuickTime Player is reported prone to remote integer overflow
vulnerability (exploitable via remotely originated content).

Improper movie attributes could result in a very large memory copy,
which lead to potencial memory overwrite.

The vulnerability may lead to remote code execution when specially
crafted video file (MOV file) is being loaded.

III. POC CODE

Due to severity of this bug i will not release any proof of concept
codes for this issue.

IV. VENDOR RESPONSE

Vendor (Apple) has been noticed and released all necessary patches.




best regards,
Piotr Bania

--
--------------------------------------------------------------------
Piotr Bania - <bania.piotr@gmail.com> - 0xCD, 0x19
Fingerprint: 413E 51C7 912E 3D4E A62A BFA4 1FF6 689F BE43 AC33
http://pb.specialised.info - Key ID: 0xBE43AC33
--------------------------------------------------------------------

" Dinanzi a me non fuor cose create
se non etterne, e io etterno duro.
Lasciate ogne speranza, voi ch'intrate "
- Dante, Inferno Canto III

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    0 Files
  • 21
    Mar 21st
    0 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close