Details on Dino’s QuickTime Advisory (With Code Snippet)

Thomas Ptacek | May 1st, 2007 | Filed Under: Apple, Disclosure, New Findings, Uncategorized

As Dave noted, Apple has released a patch for Dino’s QuickTime finding. 3Com followed up with their advisory. Direct your attention to the nut graf:

The flaw exists within the QuickTime Java extensions (QTJava.dll), specifically the routine toQTPointer() exposed through quicktime.util.QTHandleRef. A lack of sanity checking on the parameters passed to this routine, through the Java Virtual Machine (JVM), allows an attacker to write arbitrary values to memory.

What this is saying:

  • If you have the QuickTime for Java extensions installed (in other words, if you have QuickTime installed),

  • then a Java applet will be allowed to construct and play with QuickTime objects, which are backed with unprotected C code,

  • and specifically, some of those objects wrap pointers to memory tracked by a dynamic C library,

  • and unfortunately those objects are not careful enough with the values passed to them by Java code,

  • so Java applets can overwrite arbitrary process memory directly,

  • which they should never be able to do, because keeping Java applet code from touching memory directly is the whole point of the applet sandbox.

The vulnerability appears to be an integer overflow. Translated to minimal Java code (say, the init method of an applet), it reads:

// Initialize QT
QTSession.open();

// Get a handle to anything
byte b[] = new byte[1 /*arbitrary*/];
QTHandle h = new QTHandle(b);

// Turn the handle into a pointer object. The
// large negative value throws off bounds checking.
QTPointerRef p = h.toQTPointer(-2000000000 /*off*/, 10 /*size*/);

// Write to it.
p.copyFromArray(0 /*offset*/, b /*source*/, 0, 1 /*length*/);

In applet form, this reliably crashes my browsers. It is both deliberately and organically far from being useful to an attacker. Note that without comments, it’s 5 lines of code.

Get this one patched quickly! From the ZDI advisory and the QTJava documentation it looks like it takes very little time to figure this one out.

[Update: 11:00PM EST]

Read carefully and note that ZDI’s advisory confirms QuickTime for Vista is vulnerable.

Viewing 19 Comments

Trackbacks

close Reblog this comment
Powered by Disqus · Learn more
blog comments powered by Disqus