Twenty Year Anniversary

aqatom-overflow.txt

aqatom-overflow.txt
Posted Mar 8, 2007
Authored by Sowhat | Site nevisnetworks.com

Apple QuickTime player versions below 7.1.5 suffer from a udta ATOM integer overflow vulnerability.

tags | advisory, overflow
systems | apple
advisories | CVE-2007-0714
MD5 | e1855900b469955400e7d3fc3e91ee59

aqatom-overflow.txt

Change Mirror Download
Apple QuickTime udta ATOM Integer Overflow


By Sowhat of Nevis Labs
Date: 2007.03.06


http://www.nevisnetworks.com
http://secway.org/advisory/AD20070306.txt
http://secway.org/advisory/AD20060512.txt

CVE: CVE-2007-0714

Vendor:
Apple Inc.


Affected Versions:
Apple QuickTime versions < 7.1.5


Overview:
We have discovered a critical vulnerability in Quicktime Player.
The vulnerability allows an attacker to execute arbitrary code
in the context of the user who executes QuickTime.

This vulnerability can be exploited By persuading a user to open
a carefully crafted .mov files or visit a website embedding the
malicious .mov file.

The CVE-2006-1460 does not patch the root cause of this vulnerability.


Details:
This vulnerability exists in the way Quicktime process the "udta" Atom of
the .mov files.

The layout of a udta(user data atom) atom:

Bytes
_______________________
| User data atom |
| Atom size | 4
| Type = 'udta' | 4
| |
| User data list |
| Atom size | 4
| Type = user data types| 4
| |
-----------------------



By setting the value of the Atom size to a large value such as 0xFFFFFFFF,
an insufficiently-sized heap block will be allocated, and resulting in a
classic complete heap memory overwrite during the RtlAllocateHeap() function.




Vendor Response:

2006.05.06 Vendor notified via product-security@apple.com
2006.05.07 Vendor responded
2006.05.09 Vendor ask for more information
2006.05.11 Vendor released QuickTime 7.1, the code path was
influenced, but the root cause was not fixed.
2007.03.06 Vendor released the fixed version
2007.03.06 Advisory release



Reference:
1. http://developer.apple.com/documentation/QuickTime/QTFF/index.html
2. http://docs.info.apple.com/article.html?artnum=305149
3. http://secway.org/advisory/AD20060512.txt






--
Sowhat
http://secway.org
"Life is like a bug, Do you know how to exploit it ?"

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

June 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    14 Files
  • 2
    Jun 2nd
    1 Files
  • 3
    Jun 3rd
    3 Files
  • 4
    Jun 4th
    18 Files
  • 5
    Jun 5th
    21 Files
  • 6
    Jun 6th
    9 Files
  • 7
    Jun 7th
    16 Files
  • 8
    Jun 8th
    18 Files
  • 9
    Jun 9th
    5 Files
  • 10
    Jun 10th
    2 Files
  • 11
    Jun 11th
    21 Files
  • 12
    Jun 12th
    34 Files
  • 13
    Jun 13th
    15 Files
  • 14
    Jun 14th
    16 Files
  • 15
    Jun 15th
    4 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    0 Files
  • 20
    Jun 20th
    0 Files
  • 21
    Jun 21st
    0 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close