| Apple QuickTime (QuickTime.qts) Heap Overflow Vulnerability
Security-Corporation ID : SC-1012
URL : http://www.security-corporation.com/assets/security/articles-20040503-002.html
Author : EEYE <eeye_@_eeye.com>
Product : Apple QuickTime (QuickTime.qts)
Source Message Contents :
Apple QuickTime (QuickTime.qts) Heap Overflow
May 02, 2004
February 18, 2004
High (Code Execution)
Apple QuickTime 6.5
Apple iTunes 188.8.131.52
The Apple QuickTime media player is used for playing, interacting with
or viewing video, audio, VR or graphics files. Many popular web
browsers, media players, and other applications use their libraries to
play various QuickTime movie formats through their applications.
eEye Digital Security has discovered a critical vulnerability in
QuickTime Player. The vulnerability allows a remote attacker to
overwrite heap memory with user-controlled data and execute arbitrary
code within the SYSTEM context.
This specific flaw exists within the QuickTime.qts file which many
applications access QuickTime's functionality through. By specially
crafting atoms within a movie file, a direct heap overwrite is
triggered, and reliable code execution is then possible.
The code in QuickTime.qts responsible for copying Sample-to-Chunk
entries from the 'stsc' atom data in a QuickTime-format movie into an
array allocated on the heap. According to developer.apple.com, the
format of the Sample-to-Chunk atom is as follows:
Offset Type Description
------- ------- --------------------------------
0000h DWORD atom size
0004h DWORD atom type tag ('stsc')
0008h BYTE version
0009h BYTE flags
000Ch DWORD number of entries
0010h ... sample-to-chunk table data
The heap block intended to hold the sample-to-chunk table data is
allocated with a size equal to (number_of_entries + 2) * 16. By
supplying the "number of entries" field with the value 0x0FFFFFFE
greater, an absolutely classic integer overflow results that causes an
insufficiently-sized heap block to be allocated, resulting in an
classic complete heap memory overwrite.
It is difficult to express just how textbook this vulnerability
really is. Successful exploitation of the vulnerability is
self-evident, and therefore no further discussion is warranted. It is
our sincere hope that the vendor will make an earnest effort to
the maturity of its security response capabilities, so that
will be encouraged to continue to work with them amicably on future
security issues. Apple is doing a disservice to its customers by
incorrectly labeling this vulnerability as a "crash bug" rather
stating correctly that attackers can compromise systems running the
affected Apple software.
QuickTime: QuickTime File Format
Apple has released a patch for this vulnerability. The patch is
available via the Updates section of the affected applications.
This vulnerability has been assigned the CVE identifier CAN-2004-0431.
Riley Hassell, Fuzen, Cubby, the ladies in the band MudBath, Zoe bird,
Michelle L., and of course the entire staff at eEye.
Copyright (c) 1998-2004 eEye Digital Security Permission is hereby
granted for the redistribution of this alert electronically. It is not
to be edited in any way without express consent of eEye. If you wish
reprint the whole or any part of this alert in any other medium
excluding electronic medium, please email alert@eEye.com for
The information within this paper may change without notice. Use of
information constitutes acceptance for use in an AS IS condition.
are NO warranties with regard to this information. In no event shall
author be liable for any damages whatsoever arising out of or in
connection with the use or spread of this information. Any use of this
information is at the user's own risk.
Please send suggestions, updates, and comments to:
eEye Digital Security