Apple QuickTime Player Remote Heap Overflow
  by Piotr Bania <bania.piotr@gmail.com>
  http://www.piotrbania.com
  All rights reserved.


  Severity:     Critical - potencial remote code execution.


  Software affected:  Tested on QucikTime 7.1 (Windows version), with 
        all newest add-ons.


  Timeline:    03/09/2006 Vulerability sent to the vendor.
        03/09/2006 Initial vendor response.
        06/03/2007 Security bulletin released.


  Orginal url:    http://www.piotrbania.com/all/adv/quicktime-heap-adv-7.1.txt




  0.   DISCLAIMER

  Author takes no responsibility for any actions with provided informations or 
  codes. The copyright for any material created by the author is reserved. Any 
  duplication of codes or texts provided here in electronic or printed 
  publications is not permitted without the author's agreement. 

  I.   BACKGROUND

  Apple QuickTime Player is one of the Apple QuickTime components 
  used by hundreds of millions of users.


  II.  DESCRIPTION

  Apple QuickTime Player is reported prone to remote heap overflow
  vulnerability (exploitable via remotely originated content).


  Lets take a look of allocated heap blocks:

  ----// SNIP SNIP //-------------------------------------------------
  K: 66191 -> [*] HeapAlloc(0x00f00000,0x00000000,0x00000050(00000080))=0x013a0e68 end at: 0x013a0eb8
  K: 66192 -> [*] HeapAlloc(0x01160000,0x00000001,0x00000057(00000087))=0x01228c40 end at: 0x01228c97
  K: 66193 -> [*] HeapAlloc(0x01160000,0x00000001,0x0000002b(00000043))=0x01228cb0 end at: 0x01228cdb
     -> [*] HeapFree(0x1160000,0x1,0x1228C40)
     -> [*] Freed()
           -> [*] HeapFree(0x1160000,0x1,0x1228CB0)
           -> [*] Freed()
  K: 66194 -> [*] HeapAlloc(0x01160000,0x00000001,0x00000028(00000040))=0x01228c40 end at: 0x01228c68
     -> [*] HeapFree(0x1160000,0x1,0x1228C40)
           -> [*] Freed()
  K: 66195 -> [*] HeapAlloc(0x00f00000,0x00000008,0x00000020(00000032))=0x013a0ed0 end at: 0x013a0ef0
  K: 66196 -> [*] HeapAlloc(0x01160000,0x00000001,0x00000028(00000040))=0x01228c40 end at: 0x01228c68 *(A)
           -> [*] HeapFree(0x1160000,0x1,0x1228C40)                *(B)
  ----// SNIP SNIP //-------------------------------------------------


  The memory block, marked as A is being corrupted here:

  ----// SNIP SNIP //-------------------------------------------------
  66949879   8901             MOV DWORD PTR DS:[ECX],EAX
  ----// SNIP SNIP //-------------------------------------------------

  This leads to future problems within next operations on heap blocks, here with
  freeing the broken heap memory block (freeing done by point marked as B).

  The vulnerability may lead to remote code execution when specially 
  crafted MOV file is being loaded.


  III. BONUS :)

  Stack unwind:

  ----// SNIP SNIP //-------------------------------------------------
  0013beac 77f851ee 00f80000 02884278 0013bf40 ntdll!RtlSizeHeap+0x7d7
  0013bf88 77f9e227 00f80000 50000061 02884280 ntdll!RtlSizeHeap+0x1ed8
  0013bffc 77f85010 00f80000 50000061 02884280 ntdll!RtlpNtEnumerateSubKey+0x65d5
  0013c0d4 77f58b37 00f80000 40000061 02884280 ntdll!RtlSizeHeap+0x1cfa
  0013c1a4 668f51d4 00f80000 00000001 02884280 ntdll!RtlFreeHeap+0xf9
  0013c218 669644a1 02876e4e 0013c2e0 0013c33c QuickTime!theQTMLDispatcher+0x27a34
  0013c234 668daf8e 00000000 00000020 00181628 QuickTime!LIST_ComponentDispatch+0x665b1
  0013c250 668cd61e 02876e4e 00000000 00000000 QuickTime!theQTMLDispatcher+0xd7ee
  0013c29c 77f58a3a 668a8189 00f40000 40000068 QuickTime!CallComponentFunctionWithStorage+0xd0e
  0013c2a0 668a8189 00f40000 40000068 668a81bb ntdll!RtlAllocateHeap+0xe8c
  0013c2ac 668a81bb 0013c2f0 0013c33c 00181588 QuickTime!DllMain+0x579e9
  0013c2c0 668cd569 02852f60 73646573 636c6179 QuickTime!DllMain+0x57a1b
  0013c31c 66b1ac37 02852f60 73646573 636c6179 QuickTime!CallComponentFunctionWithStorage+0xc59
  0013c36c 66b1b18d 02852f60 80008002 012273c0 QuickTime!VQ_DComponentDispatch+0xd117
  00000000 00000000 00000000 00000000 00000000 QuickTime!VQ_DComponentDispatch+0xd66d
  ----// SNIP SNIP //-------------------------------------------------

  
  IV. POC CODE

  Due to severity of this bug i will not release any proof of concept 
        codes for this issue.


  IV.  VENDOR RESPONSE

  Vendor (Apple) has been noticed and released all necessary patches.