Apple QuickTime Player Remote Heap Overflow by Piotr Bania http://www.piotrbania.com All rights reserved. Severity: Critical - potencial remote code execution. Software affected: Tested on QucikTime 7.1 (Windows version), with all newest add-ons. Timeline: 03/09/2006 Vulerability sent to the vendor. 03/09/2006 Initial vendor response. 06/03/2007 Security bulletin released. Orginal url: http://www.piotrbania.com/all/adv/quicktime-heap-adv-7.1.txt 0. DISCLAIMER Author takes no responsibility for any actions with provided informations or codes. The copyright for any material created by the author is reserved. Any duplication of codes or texts provided here in electronic or printed publications is not permitted without the author's agreement. I. BACKGROUND Apple QuickTime Player is one of the Apple QuickTime components used by hundreds of millions of users. II. DESCRIPTION Apple QuickTime Player is reported prone to remote heap overflow vulnerability (exploitable via remotely originated content). Lets take a look of allocated heap blocks: ----// SNIP SNIP //------------------------------------------------- K: 66191 -> [*] HeapAlloc(0x00f00000,0x00000000,0x00000050(00000080))=0x013a0e68 end at: 0x013a0eb8 K: 66192 -> [*] HeapAlloc(0x01160000,0x00000001,0x00000057(00000087))=0x01228c40 end at: 0x01228c97 K: 66193 -> [*] HeapAlloc(0x01160000,0x00000001,0x0000002b(00000043))=0x01228cb0 end at: 0x01228cdb -> [*] HeapFree(0x1160000,0x1,0x1228C40) -> [*] Freed() -> [*] HeapFree(0x1160000,0x1,0x1228CB0) -> [*] Freed() K: 66194 -> [*] HeapAlloc(0x01160000,0x00000001,0x00000028(00000040))=0x01228c40 end at: 0x01228c68 -> [*] HeapFree(0x1160000,0x1,0x1228C40) -> [*] Freed() K: 66195 -> [*] HeapAlloc(0x00f00000,0x00000008,0x00000020(00000032))=0x013a0ed0 end at: 0x013a0ef0 K: 66196 -> [*] HeapAlloc(0x01160000,0x00000001,0x00000028(00000040))=0x01228c40 end at: 0x01228c68 *(A) -> [*] HeapFree(0x1160000,0x1,0x1228C40) *(B) ----// SNIP SNIP //------------------------------------------------- The memory block, marked as A is being corrupted here: ----// SNIP SNIP //------------------------------------------------- 66949879 8901 MOV DWORD PTR DS:[ECX],EAX ----// SNIP SNIP //------------------------------------------------- This leads to future problems within next operations on heap blocks, here with freeing the broken heap memory block (freeing done by point marked as B). The vulnerability may lead to remote code execution when specially crafted MOV file is being loaded. III. BONUS :) Stack unwind: ----// SNIP SNIP //------------------------------------------------- 0013beac 77f851ee 00f80000 02884278 0013bf40 ntdll!RtlSizeHeap+0x7d7 0013bf88 77f9e227 00f80000 50000061 02884280 ntdll!RtlSizeHeap+0x1ed8 0013bffc 77f85010 00f80000 50000061 02884280 ntdll!RtlpNtEnumerateSubKey+0x65d5 0013c0d4 77f58b37 00f80000 40000061 02884280 ntdll!RtlSizeHeap+0x1cfa 0013c1a4 668f51d4 00f80000 00000001 02884280 ntdll!RtlFreeHeap+0xf9 0013c218 669644a1 02876e4e 0013c2e0 0013c33c QuickTime!theQTMLDispatcher+0x27a34 0013c234 668daf8e 00000000 00000020 00181628 QuickTime!LIST_ComponentDispatch+0x665b1 0013c250 668cd61e 02876e4e 00000000 00000000 QuickTime!theQTMLDispatcher+0xd7ee 0013c29c 77f58a3a 668a8189 00f40000 40000068 QuickTime!CallComponentFunctionWithStorage+0xd0e 0013c2a0 668a8189 00f40000 40000068 668a81bb ntdll!RtlAllocateHeap+0xe8c 0013c2ac 668a81bb 0013c2f0 0013c33c 00181588 QuickTime!DllMain+0x579e9 0013c2c0 668cd569 02852f60 73646573 636c6179 QuickTime!DllMain+0x57a1b 0013c31c 66b1ac37 02852f60 73646573 636c6179 QuickTime!CallComponentFunctionWithStorage+0xc59 0013c36c 66b1b18d 02852f60 80008002 012273c0 QuickTime!VQ_DComponentDispatch+0xd117 00000000 00000000 00000000 00000000 00000000 QuickTime!VQ_DComponentDispatch+0xd66d ----// SNIP SNIP //------------------------------------------------- IV. POC CODE Due to severity of this bug i will not release any proof of concept codes for this issue. IV. VENDOR RESPONSE Vendor (Apple) has been noticed and released all necessary patches.