Advisory: Apple QuickTime PICT Remote Memory Overwrite
Apple QuickTime PICT Remote Memory Overwrite
by Piotr Bania <bania.piotr@xxxxxxxxx>
http://pb.specialised.info
All rights reserved.
CVE-ID: CVE-2005-2756
Original location:
http://pb.specialised.info/all/adv/quicktime-pict-adv.txt
Severity: Critical - remote code execution.
Software affected: QuickTime package 7.0.1 for Mac OS X 10.3
QuickTime package 7.0.1 for Mac OS X 10.4
QuickTime package 6.5.2 for Mac OS X 10.3
QuickTime package 6.5.2 for Mac OS X 10.2
QuickTime package 7* for Windows
Older versions may be also vulnerable.
Note: Following versions are not vulnerable, due to
the fact I have reported the vulnerabilities
before their releases:
QuickTime package 7.0.2 for Mac OS X 10.3
QuickTime package 7.0.2 for Mac OS X 10.4
0. DISCLAIMER
Author takes no responsibility for any actions with provided
informations or codes. The copyright for any material created by the
author is reserved. Any duplication of codes or texts provided here in
electronic or printed publications is not permitted without the author's
agreement.
I. BACKGROUND
Apple QuickTime PictureViewer is one of the Apple QuickTime components
used by hundreds of millions of users.
II. DESCRIPTION
Apple QuickTime PictureViewer is reported prone to remote memory
overwrite vulnerability (exploitable via remotely originated content).
Expansion of compressed PICT data could exceed the size of the
destination buffer, this cause an memory overwrite.
The vulnerability may lead to remote code execution when specially
crafted picture file (PICT file) is being loaded.
III. POC CODE
Due to severity of this bug i will not release any proof of concept
codes for this issue.
IV. VENDOR RESPONSE
Vendor (Apple) has been noticed and released all necessary patches.
best regards,
Piotr Bania
--
--------------------------------------------------------------------
Piotr Bania - <bania.piotr@xxxxxxxxx> - 0xCD, 0x19
Fingerprint: 413E 51C7 912E 3D4E A62A BFA4 1FF6 689F BE43 AC33
http://pb.specialised.info - Key ID: 0xBE43AC33
--------------------------------------------------------------------
" Dinanzi a me non fuor cose create
se non etterne, e io etterno duro.
Lasciate ogne speranza, voi ch'intrate "
- Dante, Inferno Canto III