Apple QuickTime PictureViewer JPEG/PICT File Buffer Overflow Vulnerability
BID:16212
Info
Apple QuickTime PictureViewer JPEG/PICT File Buffer Overflow Vulnerability
| Bugtraq ID: | 16212 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2005-2340 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 11 2006 12:00AM |
| Updated: | Nov 15 2007 12:35AM |
| Credit: | Dennis Rand of CIRT.DK is credited with the discovery of this vulnerability. |
| Vulnerable: |
Apple QuickTime Player 7.0.4 Apple QuickTime Player 7.0.3 Apple QuickTime Player 7.0.2 Apple QuickTime Player 7.0.1 Apple QuickTime Player 7.0 Apple QuickTime Player 6.5.2 Apple QuickTime Player 6.4 |
| Not Vulnerable: | |
Discussion
Apple QuickTime PictureViewer JPEG/PICT File Buffer Overflow Vulnerability
Apple QuickTime is prone to a buffer-overflow vulnerability because the application fails to do proper bounds checking on user-supplied data before copying it to finite-sized process buffers.
An attacker may be able to exploit this issue to execute arbitrary machine code in the context of the affected application, but this has not been confirmed. Unsuccessful exploit attempts will most likely crash the application.
This issue affects QuickTime 6.5.2 and 7.0.3; other versions may also be vulnerable. QuickTime 7.0.4 may also be vulnerable, but this has not been confirmed.
This issue may have previously been discussed in BID 16202 (Apple QuickTime Multiple Code Execution Vulnerabilities).
Apple QuickTime is prone to a buffer-overflow vulnerability because the application fails to do proper bounds checking on user-supplied data before copying it to finite-sized process buffers.
An attacker may be able to exploit this issue to execute arbitrary machine code in the context of the affected application, but this has not been confirmed. Unsuccessful exploit attempts will most likely crash the application.
This issue affects QuickTime 6.5.2 and 7.0.3; other versions may also be vulnerable. QuickTime 7.0.4 may also be vulnerable, but this has not been confirmed.
This issue may have previously been discussed in BID 16202 (Apple QuickTime Multiple Code Execution Vulnerabilities).
Exploit / POC
Apple QuickTime PictureViewer JPEG/PICT File Buffer Overflow Vulnerability
UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
The following proof of concept is available:
UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
The following proof of concept is available:
Solution / Fix
Apple QuickTime PictureViewer JPEG/PICT File Buffer Overflow Vulnerability
Solution:
Apple has released advisory APPLE-SA-2006-01-10 including QuickTime 7.0.4 to address several overflow vulnerabilities. Reports indicate that the available update also addresses this issue, but may not be a correct or complete fix. Please see the referenced 'QUICKTIME vuln: Apple pulls a Microsoft stunt' for more information. Users are also advised to contact the vendor for details.
Solution:
Apple has released advisory APPLE-SA-2006-01-10 including QuickTime 7.0.4 to address several overflow vulnerabilities. Reports indicate that the available update also addresses this issue, but may not be a correct or complete fix. Please see the referenced 'QUICKTIME vuln: Apple pulls a Microsoft stunt' for more information. Users are also advised to contact the vendor for details.
References
Apple QuickTime PictureViewer JPEG/PICT File Buffer Overflow Vulnerability
References:
References: