Advisories
Apple QuickTime FPX Integer Overflow
Release Date:
May 11, 2006
Date Reported:
March 7, 2006
Patch Development Time (In Days):
Severity:
High (Remote Code Execution)
Vendor:
Apple
Systems Affected:
Quicktime on Windows 2000
Quicktime on Windows XP
Quicktime on Mac OS X 10.3.9
Overview:
eEye Digital Security has discovered a critical vulnerability in QuickTime Player. There is a integer overflow in the way QuickTime processes fpx format files. An attacker can create a fpx file and send it to the user via email, web page, or fpx file with Activex.
Technical Details:
In an fpx file, there is a field that figures out how many blocks of data there are in that file. One block data size is 0x200, QuickTime Player will allocate memory relying on (number*0x200) but does not check the size value and an integer overflow can occur. If you set the block value to 0x800000 an integer overflow will occur which will then cause a heap overflow and write invalid memory.
Protection:
Retina Network Security Scanner has been updated to identify this vulnerability. Blink - Endpoint Vulnerability Prevention - preemptively protects from this vulnerability.
Vendor Status:
Apple has released a patch for this vulnerability information is available at http://docs.info.apple.com/article.html?artnum=61798
Credit:
Fang Xing
Related Links:
Retina Network Security Scanner - Free Trial
Blink Endpoint Vulnerability Prevention - Free Trial
Copyright (c) 1998-2008 eEye Digital Security
Permission is hereby granted for the redistribution of this alert electronically. It is not to be edited in any way without express consent of eEye. If you wish to reprint the whole or any part of this alert in any other medium excluding electronic medium, please email alert@eEye.com for permission.
Disclaimer
The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are no warranties, implied or express, with regard to this information. In no event shall the author be liable for any direct or indirect damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk.
May 11, 2006
Date Reported:
March 7, 2006
Patch Development Time (In Days):
 |
|
|
|
| 65 |
Severity:
High (Remote Code Execution)
Vendor:
Apple
Systems Affected:
Quicktime on Windows 2000
Quicktime on Windows XP
Quicktime on Mac OS X 10.3.9
Overview:
eEye Digital Security has discovered a critical vulnerability in QuickTime Player. There is a integer overflow in the way QuickTime processes fpx format files. An attacker can create a fpx file and send it to the user via email, web page, or fpx file with Activex.
Technical Details:
In an fpx file, there is a field that figures out how many blocks of data there are in that file. One block data size is 0x200, QuickTime Player will allocate memory relying on (number*0x200) but does not check the size value and an integer overflow can occur. If you set the block value to 0x800000 an integer overflow will occur which will then cause a heap overflow and write invalid memory.
Protection:
Retina Network Security Scanner has been updated to identify this vulnerability. Blink - Endpoint Vulnerability Prevention - preemptively protects from this vulnerability.
Vendor Status:
Apple has released a patch for this vulnerability information is available at http://docs.info.apple.com/article.html?artnum=61798
Credit:
Fang Xing
Related Links:
Retina Network Security Scanner - Free Trial
Blink Endpoint Vulnerability Prevention - Free Trial
Copyright (c) 1998-2008 eEye Digital Security
Permission is hereby granted for the redistribution of this alert electronically. It is not to be edited in any way without express consent of eEye. If you wish to reprint the whole or any part of this alert in any other medium excluding electronic medium, please email alert@eEye.com for permission.
Disclaimer
The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are no warranties, implied or express, with regard to this information. In no event shall the author be liable for any direct or indirect damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk.
