The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Apple QuickTime Multiple Vulnerabilities
------------------------------------------------------------------------
SUMMARY
Multiple vulnerabilities have been discovered in Apple QuickTime, these
vulnerabilities allows an attacker that can supply a malicious file to the
QuickTime player to cause it to execute arbitrary code.
DETAILS
Vulnerable Systems:
* Apple Quicktime version 7.4.1
Apple Quicktime Multiple Opcode Memory Corruption Vulnerabilities
This vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of Apple QuickTime. User interaction is required
to exploit this vulnerability in that the target must open a malicious
file.
The specific flaw exists in the quickTime.qts while parsing corrupted
pict files. The module contains a vulnerable memory copy loop which
searches for a terminator value. When this value is changed or omitted, a
heap corruption occurs allowing the execution of arbitrary code.
Vendor Response:
Apple has issued an update to correct this vulnerability. More details can
be found at: <http://support.apple.com/kb/HT1241>
http://support.apple.com/kb/HT1241
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1019>
CVE-2008-1019
Apple QuickTime Clipping Region Heap Overflow Vulnerability
This vulnerability allows attackers to execute arbitrary code on
vulnerable installations of Apple QuickTime Player. User interaction is
required to exploit this vulnerability in that the target must visit a
malicious page or open a malicious file.
The specific flaw exists within the quicktime.qts library. The
vulnerability resides in the component's parsing of 'crgn' atoms. A lack
of proper sanity checks on the region size field can result in a heap
based buffer overflow leading to arbitrary code execution under the
context of the currently logged in user.
Vendor Response:
Apple has issued an update to correct this vulnerability. More details can
be found at: <http://support.apple.com/kb/HT1241>
http://support.apple.com/kb/HT1241
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1017>
CVE-2008-1017
Apple QuickTime MP4A Atom Parsing Heap Corruption Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of Apple QuickTime. User interaction is required
to exploit this vulnerability in that the target must visit a malicious
page.
The specific flaw exists in the parsing of the QuickTime Channel
Compositor atom. When the movie file contains a malformed 'chan' atom, a
heap corruption occurs resulting in the execution of arbitrary code.
Vendor Response:
Apple has issued an update to correct this vulnerability. More details can
be found at: <http://support.apple.com/kb/HT1241>
http://support.apple.com/kb/HT1241
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1018>
CVE-2008-1018
Apple QuickTime Kodak Encoding Heap Overflow Vulnerability
This vulnerability allows attackers to execute arbitrary code on
vulnerable installations of Apple QuickTime Player. User interaction is
required to exploit this vulnerability in that the target must visit a
malicious page or open a malicious file.
The specific flaw exists within the quicktime.qts library responsible for
parsing Kodak encoded images. A lack of proper error checking can result
in a heap based buffer overflow leading to arbitrary code execution under
the context of the currently logged in user.
Vendor Response:
Apple has issued an update to correct this vulnerability. More details can
be found at: <http://support.apple.com/kb/HT1241>
http://support.apple.com/kb/HT1241
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1020>
CVE-2008-1020
Apple QuickTime Run Length Encoding Heap Overflow Vulnerability
This vulnerability allows attackers to execute arbitrary code on
vulnerable installations of Apple QuickTime Player. User interaction is
required to exploit this vulnerability in that the target must visit a
malicious page or open a malicious file.
The specific flaw exists within the parsing of QuickTime files that
utilize the Animation codec. A lack of proper length checks can result in
a heap based buffer overflow leading to arbitrary code execution under the
context of the currently logged in user.
Vendor Response:
Apple has issued an update to correct this vulnerability. More details can
be found at: <http://support.apple.com/kb/HT1241>
http://support.apple.com/kb/HT1241
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1021>
CVE-2008-1021
Apple QuickTime Malformed VR obji Atom Parsing Memory Corruption
Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of Apple QuickTime. User interaction is required
to exploit this vulnerability in that the target must open a malicious
file.
The specific flaw exists in the parsing of the QuickTime VR 'obji' atom.
When the size of the atom is set to 0, a stack overflow condition occurs
resulting in the execution of arbitrary code.
Vendor Response:
Apple has issued an update to correct this vulnerability. More details can
be found at: <http://support.apple.com/kb/HT1241>
http://support.apple.com/kb/HT1241
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1022>
CVE-2008-1022
ADDITIONAL INFORMATION
The information has been provided by <mailto:zdi-disclosures@3com.com>
The Zero Day Initiative (ZDI).
The original article can be found at:
<http://www.zerodayinitiative.com/advisories/ZDI-08-014>
http://www.zerodayinitiative.com/advisories/ZDI-08-014,
<http://www.zerodayinitiative.com/advisories/ZDI-08-015>
http://www.zerodayinitiative.com/advisories/ZDI-08-015,
<http://www.zerodayinitiative.com/advisories/ZDI-08-016>
http://www.zerodayinitiative.com/advisories/ZDI-08-016,
<http://www.zerodayinitiative.com/advisories/ZDI-08-017>
http://www.zerodayinitiative.com/advisories/ZDI-08-017,
<http://www.zerodayinitiative.com/advisories/ZDI-08-018 >
http://www.zerodayinitiative.com/advisories/ZDI-08-018 and
<http://www.zerodayinitiative.com/advisories/ZDI-08-019>
http://www.zerodayinitiative.com/advisories/ZDI-08-019
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
