[NEWS] Apple QuickTime udta ATOM Integer Overflow

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Apple QuickTime udta ATOM Integer Overflow
------------------------------------------------------------------------


SUMMARY

A critical vulnerability in Quicktime Player has been discovered. The
vulnerability allows an attacker to execute arbitrary code in the context
of the user who executes QuickTime.

This vulnerability can be exploited By persuading a user to open a
carefully crafted .mov files or visit a website embedding the
malicious .mov file. The CVE-2006-1460 does not patch the root cause of
this vulnerability.

DETAILS

Vulnerable Systems:
* Apple QuickTime versions versions prior to 7.1.5

Immune Systems:
* Apple QuickTime versions 7.1.5 and higher

This vulnerability exists in the way Quicktime process the "udta" Atom of
the .mov files.

The layout of a udta(user data atom) atom:
Bytes
_______________________
| User data atom |
| Atom size | 4
| Type = 'udta' | 4
| |
| User data list |
| Atom size | 4
| Type = user data types| 4
| |
-----------------------

By setting the value of the Atom size to a large value such as 0xFFFFFFFF,
an insufficiently-sized heap block will be allocated, and resulting in a
classic complete heap memory overwrite during the RtlAllocateHeap()
function.

Vendor Response:
2006.05.06 - Vendor notified via product-security@xxxxxxxxx
2006.05.07 - Vendor responded
2006.05.09 - Vendor ask for more information
2006.05.11 - Vendor released QuickTime 7.1, the code path was influenced,
but the root cause was not fixed.
2007.03.06 -Vendor released the fixed version
2007.03.06 - Advisory release

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0714>
CVE-2007-0714


ADDITIONAL INFORMATION

The information has been provided by <mailto:smaillist@xxxxxxxxx> Sowhat.
The original article can be found at:
<http://secway.org/advisory/AD20060512.txt>
http://secway.org/advisory/AD20060512.txt



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages