[NT] Quick Time Media Player for Windows Buffer Overflow

From: support@securiteam.com
Date: 04/02/03

  • Next message: support@securiteam.com: "[EXPL] Remote Multiple Buffer Overflow Vulnerabilities in Passlogd Sniffer" 
    From: support@securiteam.com
To: list@securiteam.com
Date: 2 Apr 2003 23:52:07 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    In the US?

    Contact Beyond Security at our new California office
    housewarming rates on automated network vulnerability
    scanning. We also welcome ISPs and other resellers!

    Please contact us at: 323-882-8286 or ussales@beyondsecurity.com
    - - - - - - - - -

      Quick Time Media Player for Windows Buffer Overflow
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.apple.com/quicktime/> QuickTime Player is a popular media
    player for both the Microsoft Windows and Apple Mac platforms.
    An exploitable buffer overflow condition has been discovered in Apple
    Computer Inc.'s QuickTime Player, allowing for the remote execution of
    arbitrary code.

    DETAILS

    The vulnerability lies in the processing of long QuickTime URL's
    (quicktime:// or through the -u switch). When processing a QuickTime URL,
    the application is launched in the following manner as can be seen from
    the Windows registry key HKEY_CLASSES_ROOT/quicktime:

    %PATH TO QUICKTIME%\QuickTimePlayer.exe -u"%1"

    A URL containing 400 characters will overrun the allocated space on the
    stack overwriting the saved instruction pointer (EIP). This will thereby
    allow an attacker to redirect the flow of control. An example URL that
    will cause QuickTime player to crash is:

    quicktime://127.0.0.1/AAAA...

    Where the character 'A' is repeated 400 times.

    Detection:

    iDEFENSE has confirmed that QuickTime Player versions 5.x and 6.0 for the
    Microsoft Windows platform are vulnerable. QuickTime for MacOS is not
    vulnerable.

    Analysis:

    Any remote attacker can compromise a target system if he or she can
    convince a user to load a specially crafted exploit URL. Upon successful
    exploitation, arbitrary code can be executed under the privileges of the
    user who launched QuickTime.

    Workaround:

    Removing the QuickTime handler from the web browser or removing the
    registry key HKEY_CLASSES_ROOT/quicktime can prevent automatic
    exploitation through HTML pages.

    Vendor status:

    Apple has released QuickTime 6.1 which addresses this vulnerability. It
    is available from <http://www.apple.com/quicktime/download/> .

    ADDITIONAL INFORMATION

    The original article can be downloaded from iDEFENSE
    <http://www.idefense.com/advisory/03.31.03.txt>
    http://www.idefense.com/advisory/03.31.03.txt

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: support@securiteam.com: "[EXPL] Remote Multiple Buffer Overflow Vulnerabilities in Passlogd Sniffer"

    Relevant Pages