EEYE: Apple QuickTime (QuickTime.qts) Heap Overflow

From: Marc Maiffret (mmaiffret_at_EEYE.COM)
Date: 05/02/04

  • Next message: Aviram Jenik: "Serv-U LIST -l Parameter Buffer Overflow"
    Date:         Sun, 2 May 2004 06:41:43 -0700
    To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
    
    

    Apple QuickTime (QuickTime.qts) Heap Overflow

    Release Date:
    May 02, 2004

    Date Reported:
    February 18, 2004

    Severity:
    High (Code Execution)

    Vendor:
    Apple

    Systems Affected:
    Apple QuickTime 6.5
    Apple iTunes 4.2.0.72

    Description:
    The Apple QuickTime media player is used for playing, interacting with
    or viewing video, audio, VR or graphics files. Many popular web
    browsers, media players, and other applications use their libraries to
    play various QuickTime movie formats through their applications.

    eEye Digital Security has discovered a critical vulnerability in
    QuickTime Player. The vulnerability allows a remote attacker to reliably
    overwrite heap memory with user-controlled data and execute arbitrary
    code within the SYSTEM context.

    This specific flaw exists within the QuickTime.qts file which many
    applications access QuickTime's functionality through. By specially
    crafting atoms within a movie file, a direct heap overwrite is
    triggered, and reliable code execution is then possible.

    Technical Details:
    The code in QuickTime.qts responsible for copying Sample-to-Chunk table
    entries from the 'stsc' atom data in a QuickTime-format movie into an
    array allocated on the heap. According to developer.apple.com, the
    format of the Sample-to-Chunk atom is as follows:

      Offset Type Description
      ------- ------- --------------------------------
      0000h DWORD atom size
      0004h DWORD atom type tag ('stsc')
      0008h BYTE version
      0009h BYTE[3] flags
      000Ch DWORD number of entries
      0010h ... sample-to-chunk table data

    The heap block intended to hold the sample-to-chunk table data is
    allocated with a size equal to (number_of_entries + 2) * 16. By
    supplying the "number of entries" field with the value 0x0FFFFFFE or
    greater, an absolutely classic integer overflow results that causes an
    insufficiently-sized heap block to be allocated, resulting in an equally
    classic complete heap memory overwrite.

    It is difficult to express just how textbook this vulnerability scenario
    really is. Successful exploitation of the vulnerability is
    self-evident, and therefore no further discussion is warranted. It is
    our sincere hope that the vendor will make an earnest effort to increase
    the maturity of its security response capabilities, so that researchers
    will be encouraged to continue to work with them amicably on future
    security issues. Apple is doing a disservice to its customers by
    incorrectly labeling this vulnerability as a "crash bug" rather than
    stating correctly that attackers can compromise systems running the
    affected Apple software.

    References:
    QuickTime: QuickTime File Format
    http://developer.apple.com/documentation/QuickTime/QTFF/index.html

    Vendor Status:
    Apple has released a patch for this vulnerability. The patch is
    available via the Updates section of the affected applications.

    This vulnerability has been assigned the CVE identifier CAN-2004-0431.

    Credit:
    Karl Lynn

    Additional Research:
    Derek Soeder

    Greetings:
    Riley Hassell, Fuzen, Cubby, the ladies in the band MudBath, Zoe bird,
    Michelle L., and of course the entire staff at eEye.

    Copyright (c) 1998-2004 eEye Digital Security Permission is hereby
    granted for the redistribution of this alert electronically. It is not
    to be edited in any way without express consent of eEye. If you wish to
    reprint the whole or any part of this alert in any other medium
    excluding electronic medium, please email alert@eEye.com for permission.

    Disclaimer
    The information within this paper may change without notice. Use of this
    information constitutes acceptance for use in an AS IS condition. There
    are NO warranties with regard to this information. In no event shall the
    author be liable for any damages whatsoever arising out of or in
    connection with the use or spread of this information. Any use of this
    information is at the user's own risk.

    Feedback
    Please send suggestions, updates, and comments to:

    eEye Digital Security
    http://www.eEye.com
    info@eEye.com

    -----
    Earn up to 10 credit course hours toward the TruSecure ICSA Practitioner (TICSA) Credential and receive a TICSA exam coupon by attending the Infosecurity Canada 2004 conference. Featured speaker, Marcus J. Ranum, TruSecure inventor of the proxy firewall will present on June 3 at 11:30 AM. Visit <https://ticsa.trusecure.com> for certification details and <http://www.infosecuritycanada.com> for conference information. Become TICSA certified and see what happens!
    -----


  • Next message: Aviram Jenik: "Serv-U LIST -l Parameter Buffer Overflow"

    Relevant Pages