Advisories
Apple QuickTime (QuickTime.qts) Heap Overflow
Release Date:
May 2, 2004
Date Reported:
February 18, 2004
Patch Development Time (In Days):
Severity:
High (Code Execution)
Vendor:
Apple
Systems Affected:
Apple QuickTime 6.5
Apple iTunes 4.2.0.72
Overview:
The Apple QuickTime media player is used for playing, interacting with or viewing video, audio, VR or graphics files. Many popular web browsers, media players, and other applications use their libraries to play various QuickTime movie formats through their applications.
eEye Digital Security has discovered a critical vulnerability in QuickTime Player. The vulnerability allows a remote attacker to reliably overwrite heap memory with user-controlled data and execute arbitrary code in the context of the user who executed the player or application hosting the QuickTime plug-in.
This specific flaw exists within the QuickTime.qts file which many applications access QuickTime's functionality through. By specially crafting atoms within a movie file, a direct heap overwrite is triggered, and reliable code execution is then possible.
Technical Details:
Technical Description:
The code in QuickTime.qts responsible for copying Sample-to-Chunk table entries from the 'stsc' atom data in a QuickTime-format movie into an array allocated on the heap. According to developer.apple.com, the format of the Sample-to-Chunk atom is as follows:
Offset Type Description
------- ------- --------------------------------
0000h DWORD atom size
0004h DWORD atom type tag ('stsc')
0008h BYTE version
0009h BYTE[3] flags
000Ch DWORD number of entries
0010h ... sample-to-chunk table data
The heap block intended to hold the sample-to-chunk table data is allocated with a size equal to (number_of_entries + 2) * 16. By supplying the "number of entries" field with the value 0x0FFFFFFE or greater, an absolutely classic integer overflow results that causes an insufficiently-sized heap block to be allocated, resulting in an equally classic complete heap memory overwrite.
It is difficult to express just how textbook this vulnerability scenario really is. Successful exploitation of the vulnerability is self-evident, and therefore no further discussion is warranted. It is our sincere hope that the vendor will make an earnest effort to increase the maturity of its security response capabilities, so that researchers will be encouraged to continue to work with them amicably on future security issues. Apple is doing a disservice to its customers by incorrectly labeling this vulnerability as a "crash bug" rather than stating correctly that attackers can compromise systems running the affected Apple software.
References
QuickTime: QuickTime File Format
http://developer.apple.com/documentation/QuickTime/QTFF/index.html
Protection:
Retina Network Security Scanner has been updated to identify this vulnerability.
Vendor Status:
Apple has released a patch for this vulnerability. The patch is available via the Updates section of the affected applications.
This vulnerability has been assigned the CVE identifier CAN-2004-0431.
Credit:
Discovery: Karl Lynn
Additional Research: Derek Soeder
Related Links:
Retina Network Security Scanner - Free 15 Day Trial http://www.eeye.com/html/Products/Retina/download.html
Greetings:
Riley Hassell, Fuzen, Cubby, the ladies in the band MudBath, Zoe bird, Michelle L., and of course the entire staff at eEye.
Copyright (c) 1998-2008 eEye Digital Security
Permission is hereby granted for the redistribution of this alert electronically. It is not to be edited in any way without express consent of eEye. If you wish to reprint the whole or any part of this alert in any other medium excluding electronic medium, please email alert@eEye.com for permission.
Disclaimer
The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are no warranties, implied or express, with regard to this information. In no event shall the author be liable for any direct or indirect damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk.
May 2, 2004
Date Reported:
February 18, 2004
Patch Development Time (In Days):
 |
|
|
|
| 74 |
Severity:
High (Code Execution)
Vendor:
Apple
Systems Affected:
Apple QuickTime 6.5
Apple iTunes 4.2.0.72
Overview:
The Apple QuickTime media player is used for playing, interacting with or viewing video, audio, VR or graphics files. Many popular web browsers, media players, and other applications use their libraries to play various QuickTime movie formats through their applications.
eEye Digital Security has discovered a critical vulnerability in QuickTime Player. The vulnerability allows a remote attacker to reliably overwrite heap memory with user-controlled data and execute arbitrary code in the context of the user who executed the player or application hosting the QuickTime plug-in.
This specific flaw exists within the QuickTime.qts file which many applications access QuickTime's functionality through. By specially crafting atoms within a movie file, a direct heap overwrite is triggered, and reliable code execution is then possible.
Technical Details:
Technical Description:
The code in QuickTime.qts responsible for copying Sample-to-Chunk table entries from the 'stsc' atom data in a QuickTime-format movie into an array allocated on the heap. According to developer.apple.com, the format of the Sample-to-Chunk atom is as follows:
Offset Type Description
------- ------- --------------------------------
0000h DWORD atom size
0004h DWORD atom type tag ('stsc')
0008h BYTE version
0009h BYTE[3] flags
000Ch DWORD number of entries
0010h ... sample-to-chunk table data
The heap block intended to hold the sample-to-chunk table data is allocated with a size equal to (number_of_entries + 2) * 16. By supplying the "number of entries" field with the value 0x0FFFFFFE or greater, an absolutely classic integer overflow results that causes an insufficiently-sized heap block to be allocated, resulting in an equally classic complete heap memory overwrite.
It is difficult to express just how textbook this vulnerability scenario really is. Successful exploitation of the vulnerability is self-evident, and therefore no further discussion is warranted. It is our sincere hope that the vendor will make an earnest effort to increase the maturity of its security response capabilities, so that researchers will be encouraged to continue to work with them amicably on future security issues. Apple is doing a disservice to its customers by incorrectly labeling this vulnerability as a "crash bug" rather than stating correctly that attackers can compromise systems running the affected Apple software.
References
QuickTime: QuickTime File Format
http://developer.apple.com/documentation/QuickTime/QTFF/index.html
Protection:
Retina Network Security Scanner has been updated to identify this vulnerability.
Vendor Status:
Apple has released a patch for this vulnerability. The patch is available via the Updates section of the affected applications.
This vulnerability has been assigned the CVE identifier CAN-2004-0431.
Credit:
Discovery: Karl Lynn
Additional Research: Derek Soeder
Related Links:
Retina Network Security Scanner - Free 15 Day Trial http://www.eeye.com/html/Products/Retina/download.html
Greetings:
Riley Hassell, Fuzen, Cubby, the ladies in the band MudBath, Zoe bird, Michelle L., and of course the entire staff at eEye.
Copyright (c) 1998-2008 eEye Digital Security
Permission is hereby granted for the redistribution of this alert electronically. It is not to be edited in any way without express consent of eEye. If you wish to reprint the whole or any part of this alert in any other medium excluding electronic medium, please email alert@eEye.com for permission.
Disclaimer
The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are no warranties, implied or express, with regard to this information. In no event shall the author be liable for any direct or indirect damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk.
