Apple QuickTime PictureViewer PICT远程内存覆盖漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1197399 漏洞类型 缓冲区溢出
发布时间 2005-11-03 更新时间 2005-11-03
CVE编号 CVE-2005-2756 CNNVD-ID CNNVD-200511-132
漏洞平台 N/A CVSS评分 5.1
|漏洞来源
https://www.securityfocus.com/bid/15309
https://cxsecurity.com/issue/WLB-2005110009
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200511-132
|漏洞详情
AppleQuickTimePictureViewer是QuickTime软件包的一个组件,是一款功能强大使用方便的图片浏览工具。AppleQuickTimePictureViewer在解压特制的压缩图形文件(PICT文件)时可能会超出目标缓冲区的大小,导致内存覆盖。成功利用这个漏洞的攻击者可能导致远程执行任意代码。
|漏洞EXP
Apple QuickTime PICT Remote Memory Overwrite
by Piotr Bania <bania.piotr (at) gmail (dot) com [email concealed]>
http://pb.specialised.info
All rights reserved.

CVE-ID: 		CVE-2005-2756

Original location:
http://pb.specialised.info/all/adv/quicktime-pict-adv.txt

Severity: 		Critical - remote code execution.

Software affected:	QuickTime package 7.0.1 for Mac OS X 10.3
			QuickTime package 7.0.1 for Mac OS X 10.4
			QuickTime package 6.5.2 for Mac OS X 10.3
			QuickTime package 6.5.2 for Mac OS X 10.2
			QuickTime package 7* for Windows

Older versions may be also vulnerable.

Note:			Following versions are not vulnerable, due to
			the fact I have reported the vulnerabilities
			before their releases:
	
			QuickTime package 7.0.2 for Mac OS X 10.3
			QuickTime package 7.0.2 for Mac OS X 10.4

0.   DISCLAIMER

Author takes no responsibility for any actions with provided
informations or codes. The copyright for any material created by the
author is reserved. Any duplication of codes or texts provided here in
electronic or printed publications is not permitted without the author's
agreement.

I.   BACKGROUND

Apple QuickTime PictureViewer is one of the Apple QuickTime components
used by hundreds of millions of users.

II.  DESCRIPTION

Apple QuickTime PictureViewer is reported prone to remote memory
overwrite vulnerability (exploitable via remotely originated content).

Expansion of compressed PICT data could exceed the size of the
destination buffer, this cause an memory overwrite.

The vulnerability may lead to remote code execution when specially
crafted picture file (PICT file) is being loaded.

III. POC CODE

Due to severity of this bug i will not release any proof of concept
codes for this issue.

IV.  VENDOR RESPONSE

Vendor (Apple) has been noticed and released all necessary patches.

best regards,
Piotr Bania

-- 
--------------------------------------------------------------------
Piotr Bania - <bania.piotr (at) gmail (dot) com [email concealed]> - 0xCD, 0x19
Fingerprint: 413E 51C7 912E 3D4E A62A  BFA4 1FF6 689F BE43 AC33
http://pb.specialised.info  - Key ID: 0xBE43AC33
--------------------------------------------------------------------

" Dinanzi a me non fuor cose create
                             se non etterne, e io etterno duro.
                             Lasciate ogne speranza, voi ch'intrate "
                                           - Dante, Inferno Canto III
|受影响的产品
Apple QuickTime Player 7.0.2 Apple QuickTime Player 7.0.1 Apple QuickTime Player 7.0 Apple QuickTime Player 6.5.2 Apple QuickTime Player 6.5.1 Apple QuickTime Player 6.5
|参考资料

来源:US-CERT
名称:VU#855118
链接:http://www.kb.cert.org/vuls/id/855118
来源:SECTRACK
名称:1015152
链接:http://securitytracker.com/id?1015152
来源:BID
名称:15309
链接:http://www.securityfocus.com/bid/15309
来源:BUGTRAQ
名称:20051104Advisory:AppleQuickTimePICTRemoteMemoryOverwrite
链接:http://www.securityfocus.com/archive/1/archive/1/415714/30/0/threaded
来源:OSVDB
名称:20478
链接:http://www.osvdb.org/20478
来源:VUPEN
名称:ADV-2005-2293
链接:http://www.frsirt.com/english/advisories/2005/2293
来源:SECUNIA
名称:17428
链接:http://secunia.com/advisories/17428
来源:MISC
链接:http://pb.specialised.info/all/adv/quicktime-pict-adv.txt
来源:docs.info.apple.com
链接:http://docs.info.apple.com/article.html?artnum=302772
来源:SREASON
名称:144
链接:http://securityreason.com/securityalert/144