[NEWS] Apple QuickTime QTIF Stack Overflow

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Apple QuickTime QTIF Stack Overflow
------------------------------------------------------------------------


SUMMARY

<http://www.apple.com/quicktime/> QuickTime is "a multimedia technology
developed by Apple Computer, capable of handling various formats of
digital video, sound, text, animation, music, and immersive panoramic (and
sphere panoramic) images".

There is a stack overflow in the way QuickTime processes qtif format
files. An attacker can create a qtif file and send it to the user via
email, web page, or qtif file with activex and can directy overflow a
function pointer immediately used so it can bypass any stack overflow
protection in systems such as Windows XP SP2 and Windows 2003 SP1.

DETAILS

Vulnerable Systems:
* Quicktime on Windows 2000
* Quicktime on Windows XP
* Quicktime on Mac OS X 10.3.9

When Quicktime processes the data field of a qtif format file, it will
copy it to the stack by a byte to a byte , but there is no proper
checking, so it will cause a stack overflow in memory. And in this stack,
there is a function pointer which will be used immediately when it pre
byte copies, so we can use it to bypass any stack overflow protection,
such in Windows XP SP2 and 2003 SP1.

The origin function point value is 0x44332211. We only need to overflow it
to : 0x08332211, ensuring it didn't cause a crash before the 0x44 has been
overflowed to 0x08. When it overflows to 0x08332211, we can execute code
to 0x08332211, and can first use JavaScript to get this memory and set my
code in it.

call [esp+138h+arg_4] <- call a function point in the stack, but this
point can be overflowed

References:
QuickTime: QuickTime File Format
<http://developer.apple.com/documentation/QuickTime/QTFF/index.html>
http://developer.apple.com/documentation/QuickTime/QTFF/index.html

Vendor Status:
Apple has released a patch for this vulnerability. The patch is available
via the Updates section of the affected applications.

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3713>
CVE-2005-3713


ADDITIONAL INFORMATION

The information has been provided by <mailto:Advisories@xxxxxxxx> eEye.
The original article can be found at:
<http://www.eeye.com/html/research/advisories/AD20060111c.html>
http://www.eeye.com/html/research/advisories/AD20060111c.html



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages