Exploit the possiblities

quicktime-pict-adv.txt

quicktime-pict-adv.txt
Posted Nov 4, 2005
Authored by Piotr Bania | Site pb.specialised.info

Apple QuickTime PictureViewer is reported prone to remote memory overwrite vulnerability (exploitable via remotely originated content). Expansion of compressed PICT data could exceed the size of the destination buffer, this cause an memory overwrite. The vulnerability may lead to remote code execution when specially crafted picture file (PICT file) is being loaded. Software affected: QuickTime package 7.0.1 for Mac OS X 10.3, QuickTime package 7.0.1 for Mac OS X 10.4, QuickTime package 6.5.2 for Mac OS X 10.3, QuickTime package 6.5.2 for Mac OS X 10.2, QuickTime package 7x for Windows.

tags | advisory, remote, code execution
systems | windows, apple, osx
advisories | CVE-2005-2756
MD5 | b9e93bbe39bd79cdd794441f8de22a7a

quicktime-pict-adv.txt

Change Mirror Download




Apple QuickTime PICT Remote Memory Overwrite
by Piotr Bania <bania.piotr@gmail.com>
http://pb.specialised.info
All rights reserved.


CVE-ID: CVE-2005-2756

Original location:
http://pb.specialised.info/all/adv/quicktime-pict-adv.txt

Severity: Critical - remote code execution.

Software affected: QuickTime package 7.0.1 for Mac OS X 10.3
QuickTime package 7.0.1 for Mac OS X 10.4
QuickTime package 6.5.2 for Mac OS X 10.3
QuickTime package 6.5.2 for Mac OS X 10.2
QuickTime package 7* for Windows

Older versions may be also vulnerable.

Note: Following versions are not vulnerable, due to
the fact I have reported the vulnerabilities
before their releases:

QuickTime package 7.0.2 for Mac OS X 10.3
QuickTime package 7.0.2 for Mac OS X 10.4



0. DISCLAIMER

Author takes no responsibility for any actions with provided
informations or codes. The copyright for any material created by the
author is reserved. Any duplication of codes or texts provided here in
electronic or printed publications is not permitted without the author's
agreement.

I. BACKGROUND

Apple QuickTime PictureViewer is one of the Apple QuickTime components
used by hundreds of millions of users.

II. DESCRIPTION

Apple QuickTime PictureViewer is reported prone to remote memory
overwrite vulnerability (exploitable via remotely originated content).

Expansion of compressed PICT data could exceed the size of the
destination buffer, this cause an memory overwrite.

The vulnerability may lead to remote code execution when specially
crafted picture file (PICT file) is being loaded.

III. POC CODE

Due to severity of this bug i will not release any proof of concept
codes for this issue.

IV. VENDOR RESPONSE

Vendor (Apple) has been noticed and released all necessary patches.




best regards,
Piotr Bania

--
--------------------------------------------------------------------
Piotr Bania - <bania.piotr@gmail.com> - 0xCD, 0x19
Fingerprint: 413E 51C7 912E 3D4E A62A BFA4 1FF6 689F BE43 AC33
http://pb.specialised.info - Key ID: 0xBE43AC33
--------------------------------------------------------------------

" Dinanzi a me non fuor cose create
se non etterne, e io etterno duro.
Lasciate ogne speranza, voi ch'intrate "
- Dante, Inferno Canto III


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

January 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    2 Files
  • 2
    Jan 2nd
    13 Files
  • 3
    Jan 3rd
    16 Files
  • 4
    Jan 4th
    39 Files
  • 5
    Jan 5th
    26 Files
  • 6
    Jan 6th
    40 Files
  • 7
    Jan 7th
    2 Files
  • 8
    Jan 8th
    16 Files
  • 9
    Jan 9th
    25 Files
  • 10
    Jan 10th
    28 Files
  • 11
    Jan 11th
    44 Files
  • 12
    Jan 12th
    32 Files
  • 13
    Jan 13th
    2 Files
  • 14
    Jan 14th
    4 Files
  • 15
    Jan 15th
    31 Files
  • 16
    Jan 16th
    15 Files
  • 17
    Jan 17th
    16 Files
  • 18
    Jan 18th
    24 Files
  • 19
    Jan 19th
    15 Files
  • 20
    Jan 20th
    5 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    0 Files
  • 24
    Jan 24th
    0 Files
  • 25
    Jan 25th
    0 Files
  • 26
    Jan 26th
    0 Files
  • 27
    Jan 27th
    0 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close