Exploit the possiblities

quicktime-heap-adv-7.1.txt

quicktime-heap-adv-7.1.txt
Posted Mar 8, 2007
Authored by Piotr Bania | Site piotrbania.com

Apple QuickTime player version 7.1 on Windows suffers from a remote heap overflow vulnerability.

tags | advisory, remote, overflow
systems | windows, apple
MD5 | 58c3fe48a3a30c9dd27f603a5b44c1b0

quicktime-heap-adv-7.1.txt

Change Mirror Download



Apple QuickTime Player Remote Heap Overflow
by Piotr Bania <bania.piotr@gmail.com>
http://www.piotrbania.com
All rights reserved.


Severity: Critical - potencial remote code execution.


Software affected: Tested on QucikTime 7.1 (Windows version), with
all newest add-ons.


Timeline: 03/09/2006 Vulerability sent to the vendor.
03/09/2006 Initial vendor response.
06/03/2007 Security bulletin released.


Orginal url: http://www.piotrbania.com/all/adv/quicktime-heap-adv-7.1.txt




0. DISCLAIMER

Author takes no responsibility for any actions with provided informations or
codes. The copyright for any material created by the author is reserved. Any
duplication of codes or texts provided here in electronic or printed
publications is not permitted without the author's agreement.

I. BACKGROUND

Apple QuickTime Player is one of the Apple QuickTime components
used by hundreds of millions of users.


II. DESCRIPTION

Apple QuickTime Player is reported prone to remote heap overflow
vulnerability (exploitable via remotely originated content).


Lets take a look of allocated heap blocks:

----// SNIP SNIP //-------------------------------------------------
K: 66191 -> [*] HeapAlloc(0x00f00000,0x00000000,0x00000050(00000080))=0x013a0e68 end at: 0x013a0eb8
K: 66192 -> [*] HeapAlloc(0x01160000,0x00000001,0x00000057(00000087))=0x01228c40 end at: 0x01228c97
K: 66193 -> [*] HeapAlloc(0x01160000,0x00000001,0x0000002b(00000043))=0x01228cb0 end at: 0x01228cdb
-> [*] HeapFree(0x1160000,0x1,0x1228C40)
-> [*] Freed()
-> [*] HeapFree(0x1160000,0x1,0x1228CB0)
-> [*] Freed()
K: 66194 -> [*] HeapAlloc(0x01160000,0x00000001,0x00000028(00000040))=0x01228c40 end at: 0x01228c68
-> [*] HeapFree(0x1160000,0x1,0x1228C40)
-> [*] Freed()
K: 66195 -> [*] HeapAlloc(0x00f00000,0x00000008,0x00000020(00000032))=0x013a0ed0 end at: 0x013a0ef0
K: 66196 -> [*] HeapAlloc(0x01160000,0x00000001,0x00000028(00000040))=0x01228c40 end at: 0x01228c68 *(A)
-> [*] HeapFree(0x1160000,0x1,0x1228C40) *(B)
----// SNIP SNIP //-------------------------------------------------


The memory block, marked as A is being corrupted here:

----// SNIP SNIP //-------------------------------------------------
66949879 8901 MOV DWORD PTR DS:[ECX],EAX
----// SNIP SNIP //-------------------------------------------------

This leads to future problems within next operations on heap blocks, here with
freeing the broken heap memory block (freeing done by point marked as B).

The vulnerability may lead to remote code execution when specially
crafted MOV file is being loaded.


III. BONUS :)

Stack unwind:

----// SNIP SNIP //-------------------------------------------------
0013beac 77f851ee 00f80000 02884278 0013bf40 ntdll!RtlSizeHeap+0x7d7
0013bf88 77f9e227 00f80000 50000061 02884280 ntdll!RtlSizeHeap+0x1ed8
0013bffc 77f85010 00f80000 50000061 02884280 ntdll!RtlpNtEnumerateSubKey+0x65d5
0013c0d4 77f58b37 00f80000 40000061 02884280 ntdll!RtlSizeHeap+0x1cfa
0013c1a4 668f51d4 00f80000 00000001 02884280 ntdll!RtlFreeHeap+0xf9
0013c218 669644a1 02876e4e 0013c2e0 0013c33c QuickTime!theQTMLDispatcher+0x27a34
0013c234 668daf8e 00000000 00000020 00181628 QuickTime!LIST_ComponentDispatch+0x665b1
0013c250 668cd61e 02876e4e 00000000 00000000 QuickTime!theQTMLDispatcher+0xd7ee
0013c29c 77f58a3a 668a8189 00f40000 40000068 QuickTime!CallComponentFunctionWithStorage+0xd0e
0013c2a0 668a8189 00f40000 40000068 668a81bb ntdll!RtlAllocateHeap+0xe8c
0013c2ac 668a81bb 0013c2f0 0013c33c 00181588 QuickTime!DllMain+0x579e9
0013c2c0 668cd569 02852f60 73646573 636c6179 QuickTime!DllMain+0x57a1b
0013c31c 66b1ac37 02852f60 73646573 636c6179 QuickTime!CallComponentFunctionWithStorage+0xc59
0013c36c 66b1b18d 02852f60 80008002 012273c0 QuickTime!VQ_DComponentDispatch+0xd117
00000000 00000000 00000000 00000000 00000000 QuickTime!VQ_DComponentDispatch+0xd66d
----// SNIP SNIP //-------------------------------------------------


IV. POC CODE

Due to severity of this bug i will not release any proof of concept
codes for this issue.


IV. VENDOR RESPONSE

Vendor (Apple) has been noticed and released all necessary patches.


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

December 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    15 Files
  • 2
    Dec 2nd
    2 Files
  • 3
    Dec 3rd
    1 Files
  • 4
    Dec 4th
    15 Files
  • 5
    Dec 5th
    15 Files
  • 6
    Dec 6th
    18 Files
  • 7
    Dec 7th
    17 Files
  • 8
    Dec 8th
    15 Files
  • 9
    Dec 9th
    13 Files
  • 10
    Dec 10th
    4 Files
  • 11
    Dec 11th
    41 Files
  • 12
    Dec 12th
    44 Files
  • 13
    Dec 13th
    25 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close