[Full-disclosure] Ad[Full-disclosure] Advisory: Apple QuickTime Player Remote Integer Overflow (2)

Type securityvulns
Reporter Securityvulns
Modified 2005-11-04T00:00:00


Apple QuickTime Player Remote Integer Overflow (2) by Piotr Bania <bania.piotr@gmail.com> http://pb.specialised.info All rights reserved.

CVE-ID: CVE-2005-2754

Original location: http://pb.specialised.info/all/adv/quicktime-mov-io2-adv.txt

Severity: Critical - remote code execution.

Software affected: QuickTime package 7.0.1 for Mac OS X 10.3 QuickTime package 7.0.1 for Mac OS X 10.4 QuickTime package 6.5.2 for Mac OS X 10.3 QuickTime package 6.5.2 for Mac OS X 10.2 QuickTime package 7* for Windows

                    Older versions may be also vulnerable.

Note: Following versions are not vulnerable, due to the fact I have reported the vulnerabilities before their releases:

                    QuickTime package 7.0.2 for Mac OS X 10.3
                    QuickTime package 7.0.2 for Mac OS X 10.4

Author takes no responsibility for any actions with provided informations or codes. The copyright for any material created by the author is reserved. Any duplication of codes or texts provided here in electronic or printed publications is not permitted without the author's agreement.


Apple QuickTime Player is one of the Apple QuickTime components used by hundreds of millions of users.


Apple QuickTime Player is reported prone to remote integer overflow vulnerability (exploitable via remotely originated content).

Improper movie attributes could result in a very large memory copy, which lead to potencial memory overwrite.

The vulnerability may lead to remote code execution when specially crafted video file (MOV file) is being loaded.


Due to severity of this bug i will not release any proof of concept codes for this issue.


Vendor (Apple) has been noticed and released all necessary patches.

best regards, Piotr Bania


Piotr Bania - <bania.piotr@gmail.com> - 0xCD, 0x19 Fingerprint: 413E 51C7 912E 3D4E A62A BFA4 1FF6 689F BE43 AC33 http://pb.specialised.info - Key ID: 0xBE43AC33

                       &quot; Dinanzi a me non fuor cose create
                         se non etterne, e io etterno duro.
                         Lasciate ogne speranza, voi ch&#39;intrate &quot;
                                       - Dante, Inferno Canto III

Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/