|
|
|
|
| |
Credit:
The information has been provided by eEye.
The original article can be found at: http://www.eeye.com/html/research/advisories/AD20060111a.html
|
| |
Vulnerable Systems:
* Quicktime on Windows 2000
* Quicktime on Windows XP
* Quicktime on Mac OS X 10.3.9
Immune Systems:
* Apple iTunes on Windows 2000
* Apple iTunes on Windows XP
* Apple iTunes on OS X 10.3.9
This specific flaw exists within the QuickTime.qts file which many applications access QuickTime's functionality through. By specially crafting atoms within a movie file, a direct heap overwrite is triggered, and reliable code execution is then possible.
The code in QuickTime.qts responsible for the size of the Sample Description Table entries from the 'stsd' atom in a QuickTime-format movie on the heap. According to developer.apple.com, the format of the Sample Description Atom is as follows:
Field Description
----------------------------------------------------------------
Size - 32-bit int
Data Format - 4 char code
Reserved - 6 bytes that must be 0
Data Reference Index - 16-bit int
Hint Track Version - 16-bit unsigned int
Last compatible hint track version - 16-bit unsigned int
Max Packet Size - 32-bit int
Additional Data Table - Variable
By setting the size of the Sample Description Table to a size of 00 15 - 00 D0 will cause a heap-based overflow. By supplying the "Last compatible hint track version" field with the value of 00 05 - 00 09, an insufficiently-sized heap block will be allocated, resulting in a classic complete heap memory overwrite during the RtlAllocateHeap() function and the attacker can control memory with data taken from the filename of the .MOV file. This vulnerability can be successfully exploited via an embedded media player in an HTML page, email, or HTML link.
References:
QuickTime: QuickTime File Format
http://developer.apple.com/documentation/QuickTime/QTFF/index.html
Vendor Status:
Apple has released a patch for this vulnerability. The patch is available via the Updates section of the affected applications.
CVE Information:
CVE-2005-4092
|
|
|
|
|
