AOH :: HP Unsorted Q :: BX1374.HTM

Quicktime Player 7.3.1.70 buffer overflow



Buffer-overflow in Quicktime Player 7.3.1.70
Buffer-overflow in Quicktime Player 7.3.1.70




#######################################################################

                             Luigi Auriemma

Application:  Quicktime Player
http://www.apple.com/quicktime 
Versions:     <= 7.3.1.70
Platforms:    Windows and Mac
Bug:          buffer-overflow
Exploitation: remote
Date:         10 Jan 2008
Thanx to:     swirl for the help during the re-testing of the bug
Author:       Luigi Auriemma
e-mail: aluigi@autistici.org 
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

==============1) Introduction
==============

Quicktime is a well known media player developed by Apple.


#######################################################################

=====2) Bug
=====

The problem is a buffer-overflow which happens during the filling of
the LCD-like screen containing info about the status of the connection.

For exploiting this vulnerability is only needed that an user follows
a rtsp:// link, if the port 554 of the server is closed Quicktime will
automatically change the transport and will try the HTTP protocol on
port 80, the 404 error message of the server (other error numbers are
valid too) will be visualized in the LCD-like screen.

During my tests I have been able to fully overwrite the return address
anyway note that the visible effects of the vulnerability could change
during the usage of the debugger (in attaching mode it's everything
ok).


#######################################################################

==========3) The Code
==========

http://aluigi.org/poc/quicktimebof.txt 

  nc -l -p 80 -v -v -n < quicktimebof.txt

and then

  QuickTimePlayer.exe rtsp://127.0.0.1/file.mp3


#######################################################################

=====4) Fix
=====

No fix


#######################################################################


--- 
Luigi Auriemma
http://aluigi.org 

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.