troubleshooting/tutorials/security
01/02/2007, 1:10pm, EST
Tuesday, January 2nd
'Month of bugs' reveals QuickTime exploit
A security analyst who elected to kick off the new year with one month of Apple bugs has published the first flaw -- which resides in Apple's QuickTime software. A new post states that a vulnerability in the QuickTime rstp URL handler could allow malicious users to remotely execute code via a stack-based buffer overflow. "By supplying a specially crafted string, an attacker could overflow a stack-based buffer, using either HTML, Javascript or a QTL file as attack vector, leading to an exploitable remote arbitrary code execution condition," the anonymous security expert wrote. The example exploit, which requires a working Ruby interpreter, creates a QTL file that users can open locally or that is served remotely via a Web server. The poster notes that while the sample exploit itself is trivial in nature, the code could easily be modified to use shell code. The author also notes that the only known workaround for Mac users is to disable the rtsp:// URL handler or uninstall QuickTime entirely.
Filed under: troubleshooting
, 
, 11
, 
, 
, 
, 
, 
, 
Top
subscribe to comments
for this article
Why do I take this stance? Well it's simple. People who use exploits on the general public are idiots. They do not have the ability to find actual security flaws and exploit them. They require someone else to find them, publish them and they then follow directions.
I'll stick to being constructive instead of being an egomaniacal ass.
It would be interesting to find out if any of the things that LHM will tell us about over the next 29 days are actually orginal. I suspect not.
In the end, as sixcolors has already pointed out, mature software engineers report bugs and security issue through established bug reporting systems so that the bugs can get fixed. Children and those with ego issues do other things.
Enjoy the spotlight LHM. I hope you find what you're really looking for.
Smittie
"QuickTime Streaming Server
CVE-ID: CVE-2006-1456
Available for: Mac OS X Server v10.3.9, Mac OS X Server v10.4.6
Impact: Maliciously-crafted RTSP requests may lead to crashes or arbitrary code execution
Description: By carefully crafting an RTSP request, an attacker may be able to trigger a buffer overflow during message logging. This may lead to the arbitrary code execution with the privileges of the QuickTime Streaming Server. This update adresses the issue by properly handling the boundary conditions. Credit to the Mu Security research team for reporting this issue."
Is this not the same issue that LHM claims to be reporting??
http://docs.info.apple.com/article.html?artnum=303737
Smittie