iDEFENSE Security Advisory 03.31.03: Buffer Overflow in Windows QuickTime Player

From: iDEFENSE Labs (labs@idefense.com)
Date: 04/01/03

  • Next message: Grégory: "[SCSA-015] Remote Denial of Service Vulnerability in PowerFTP" 
    From: "iDEFENSE Labs" <labs@idefense.com>
To: bugtraq@securityfocus.com
Date: Mon, 31 Mar 2003 19:03:55 -0500

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    iDEFENSE Security Advisory 03.31.03:
    http://www.idefense.com/advisory/03.31.03.txt
    Buffer Overflow in Windows QuickTime Player
    March 31, 2003

    I. BACKGROUND

    QuickTime Player is a popular media player for both the Microsoft Windows
    and Apple Mac platforms. More information about the application is
    available at http://www.apple.com/quicktime/ .

    II. DESCRIPTION

    An exploitable buffer overflow condition has been discovered in Apple
    Computer Inc.'s QuickTime Player, allowing for the remote execution of
    arbitrary code. The vulnerability lies in the processing of long QuickTime
    URL's (quicktime:// or through the -u switch). When processing a QuickTime
    URL, the application is launched in the following manner as can be seen
    from the Windows registry key HKEY_CLASSES_ROOT/quicktime:

    %PATH TO QUICKTIME%\QuickTimePlayer.exe -u"%1"

    A URL containing 400 characters will overrun the allocated space on the
    stack overwriting the saved instruction pointer (EIP). This will thereby
    allow an attacker to redirect the flow of control. An example URL that
    will cause QuickTime player to crash is:

    quicktime://127.0.0.1/AAAA...

    Where the character 'A' is repeated 400 times.

    III. ANALYSIS

    Any remote attacker can compromise a target system if he or she can
    convince a user to load a specially crafted exploit URL. Upon successful
    exploitation, arbitrary code can be executed under the privileges of the
    user who launched QuickTime.

    IV. DETECTION

    iDEFENSE has confirmed that QuickTime Player versions 5.x and 6.0 for the
    Microsoft Windows platform are vulnerable. QuickTime for MacOS is not
    vulnerable.

    V. WORKAROUND

    Removing the QuickTime handler from the web browser or removing the
    registry key HKEY_CLASSES_ROOT/quicktime can prevent automatic
    exploitation through HTML pages.

    VI. VENDOR FIX

    Apple has released QuickTime 6.1 which addresses this vulnerability. It
    is available from http://www.apple.com/quicktime/download/ .

    VII. CVE INFORMATION

    The Mitre Corp.'s Common Vulnerabilities and Exposures (CVE) Project
    assigned the identification number CAN-2003-0168 to this issue.

    VIII. DISCLOSURE TIMELINE

    01/16/2003 Issue disclosed to iDEFENSE
    02/24/2003 iDEFENSE notification sent to product-security@apple.com
    02/24/2003 Response received from Apple Product Security team
    02/24/2003 iDEFENSE clients notified
    03/31/2003 Coordinated Public disclosure

    IX. CREDIT

    Texonet (http://www.texonet.com) is credited with discovering this
    vulnerability.

    Get paid for security research
    http://www.idefense.com/contributor.html

    Subscribe to iDEFENSE Advisories:
    send email to listserv@idefense.com, subject line: "subscribe"

    About iDEFENSE:

    iDEFENSE is a global security intelligence company that proactively
    monitors sources throughout the world — from technical
    vulnerabilities and hacker profiling to the global spread of viruses
    and other malicious code. Our security intelligence services provide
    decision-makers, frontline security professionals and network
    administrators with timely access to actionable intelligence
    and decision support on cyber-related threats. For more information,
    visit http://www.idefense.com .

    -----BEGIN PGP SIGNATURE-----
    Version: PGP 8.0

    iQA/AwUBPojWxvrkky7kqW5PEQKpugCfR7CiM+8599fwqY/2T0CyUqAMhGUAn0ZX
    Zi9OhMExCYJAdDPZdzn1JKgc
    =VDX8
    -----END PGP SIGNATURE-----

  • Next message: Grégory: "[SCSA-015] Remote Denial of Service Vulnerability in PowerFTP"

    Relevant Pages