|
Brought to you by:
Suppliers of:
|
|
|
| |
| QuickTime Player is "a media player produced by Apple. QuickTime player contains a module PictureViewer to view still images". PictureViewer for Windows suffers from a vulnerability that allows an attacker to crash the program when opening a specially crafted GIF file. |
| |
Credit:
The information has been provided by liquid.
|
| |
Vulnerable Systems:
* QuickTime Player for Windows version 6.5.2
PictureViewer does not check for correct value in the depth start field of the GIF header. In the test.gif provided below this value is set to 255 (0xff hexadecimal). When setting depth start to value between 0x00 and 0xfe PictureViewer reports that file is corrupted. It leads to assumption that there is some kind of integer overflow in processing GIF files. Also, changing the width and height of logical screen in GIF header will also provide similar results.
Exploit Code:
And here is test.gif:
00000000 :47 49 46 38 39 61 0F 01 - 0F 01 00 00 00 21 F9 04
00000010 :00 00 00 00 00 2C 00 00 - 00 00 00 01 00 01 00 FF
To exploit, open a hex editor and create a new file with the contents above, or modify an existing GIF file header.
|
|
|
|
|
