Apple QuickTime Player Remote Denial Of Service
by Piotr Bania <[email protected]>
http://pb.specialised.info
All rights reserved.
CVE-ID: CVE-2005-2755
Original location:
http://pb.specialised.info/all/adv/quicktime-mov-dos-adv.txt
Severity: Critical - attack against any application
loading remotely-originated content.
Software affected: QuickTime package 7.0.1 for Mac OS X 10.3
QuickTime package 7.0.1 for Mac OS X 10.4
QuickTime package 6.5.2 for Mac OS X 10.3
QuickTime package 6.5.2 for Mac OS X 10.2
QuickTime package 7* for Windows
Older versions may be also vulnerable.
Note: Following versions are not vulnerable, due to
the fact I have reported the vulnerabilities
before their releases:
QuickTime package 7.0.2 for Mac OS X 10.3
QuickTime package 7.0.2 for Mac OS X 10.4
Author takes no responsibility for any actions with provided
informations or codes. The copyright for any material created by the
author is reserved. Any duplication of codes or texts provided here in
electronic or printed publications is not permitted without the author's
agreement.
I. BACKGROUND
Apple QuickTime Player is one of the Apple QuickTime components
used by hundreds of millions of users.
II. DESCRIPTION
Apple QuickTime Player is reported prone to remote denial of service
attack (exploitable via remotely originated content).
A missing movie attribute is interpreted as an extension, but the
absence of the extension is not flagged as an error, resulting in
a de-reference of a NULL pointer.
This will cause a denial of service against any application loading
remotely-originated content.
III. POC CODE
Due to severity of this bug i will not release any proof of concept
codes for this issue.
IV. VENDOR RESPONSE
Vendor (Apple) has been noticed and released all necessary patches.
best regards,
Piotr Bania
" Dinanzi a me non fuor cose create
se non etterne, e io etterno duro.
Lasciate ogne speranza, voi ch'intrate "
- Dante, Inferno Canto III
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/