-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iDEFENSE Security Advisory 03.31.03: http://www.idefense.com/advisory/03.31.03.txt Buffer Overflow in Windows QuickTime Player March 31, 2003 I. BACKGROUND QuickTime Player is a popular media player for both the Microsoft Windows and Apple Mac platforms. More information about the application is available at http://www.apple.com/quicktime/ . II. DESCRIPTION An exploitable buffer overflow condition has been discovered in Apple Computer Inc.'s QuickTime Player, allowing for the remote execution of arbitrary code. The vulnerability lies in the processing of long QuickTime URL's (quicktime:// or through the -u switch). When processing a QuickTime URL, the application is launched in the following manner as can be seen from the Windows registry key HKEY_CLASSES_ROOT/quicktime: %PATH TO QUICKTIME%\QuickTimePlayer.exe -u"%1" A URL containing 400 characters will overrun the allocated space on the stack overwriting the saved instruction pointer (EIP). This will thereby allow an attacker to redirect the flow of control. An example URL that will cause QuickTime player to crash is: quicktime://127.0.0.1/AAAA... Where the character 'A' is repeated 400 times. III. ANALYSIS Any remote attacker can compromise a target system if he or she can convince a user to load a specially crafted exploit URL. Upon successful exploitation, arbitrary code can be executed under the privileges of the user who launched QuickTime. IV. DETECTION iDEFENSE has confirmed that QuickTime Player versions 5.x and 6.0 for the Microsoft Windows platform are vulnerable. QuickTime for MacOS is not vulnerable. V. WORKAROUND Removing the QuickTime handler from the web browser or removing the registry key HKEY_CLASSES_ROOT/quicktime can prevent automatic exploitation through HTML pages. VI. VENDOR FIX Apple has released QuickTime 6.1 which addresses this vulnerability. It is available from http://www.apple.com/quicktime/download/ . VII. CVE INFORMATION The Mitre Corp.'s Common Vulnerabilities and Exposures (CVE) Project assigned the identification number CAN-2003-0168 to this issue. VIII. DISCLOSURE TIMELINE 01/16/2003 Issue disclosed to iDEFENSE 02/24/2003 iDEFENSE notification sent to product-security@apple.com 02/24/2003 Response received from Apple Product Security team 02/24/2003 iDEFENSE clients notified 03/31/2003 Coordinated Public disclosure IX. CREDIT Texonet (http://www.texonet.com) is credited with discovering this vulnerability. Get paid for security research http://www.idefense.com/contributor.html Subscribe to iDEFENSE Advisories: send email to listserv@idefense.com, subject line: "subscribe" About iDEFENSE: iDEFENSE is a global security intelligence company that proactively monitors sources throughout the world ? from technical vulnerabilities and hacker profiling to the global spread of viruses and other malicious code. Our security intelligence services provide decision-makers, frontline security professionals and network administrators with timely access to actionable intelligence and decision support on cyber-related threats. For more information, visit http://www.idefense.com . -----BEGIN PGP SIGNATURE----- Version: PGP 8.0 iQA/AwUBPojWxvrkky7kqW5PEQKpugCfR7CiM+8599fwqY/2T0CyUqAMhGUAn0ZX Zi9OhMExCYJAdDPZdzn1JKgc =VDX8 -----END PGP SIGNATURE-----
