Vulnerabilities > CVE-2008-3626 - Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Apple Quicktime
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
The CallComponentFunctionWithStorage function in Apple QuickTime before 7.5.5 does not properly handle a large entry in the sample_size_table in STSZ atoms, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Buffer Overflow via Environment Variables This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
- Overflow Buffers Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
- Client-side Injection-induced Buffer Overflow This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
- Filter Failure through Buffer Overflow In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
- MIME Conversion An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.
Nessus
NASL family MacOS X Local Security Checks NASL id MACOSX_QUICKTIME755.NASL description The version of QuickTime installed on the remote Mac OS X host is older than 7.5.5. Such versions contain several vulnerabilities : - Heap and stack-based buffer overflows in the handling of panorama atoms in QTVR (QuickTime Virtual Reality) movie files could lead to an application crash or arbitrary code execution (CVE-2008-3624 and CVE-2008-3625). - A memory corruption issue in QuickTime last seen 2020-06-01 modified 2020-06-02 plugin id 34118 published 2008-09-10 reporter This script is Copyright (C) 2008-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/34118 title QuickTime < 7.5.5 Multiple Vulnerabilities (Mac OS X) code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(34118); script_version("1.15"); script_cve_id( "CVE-2008-3624", "CVE-2008-3625", "CVE-2008-3626", "CVE-2008-3627", "CVE-2008-3629" ); script_bugtraq_id(31086, 31546, 31548); script_name(english:"QuickTime < 7.5.5 Multiple Vulnerabilities (Mac OS X)"); script_summary(english:"Checks version of QuickTime on Mac OS X"); script_set_attribute(attribute:"synopsis", value: "The remote Mac OS X host contains an application that is affected by multiple vulnerabilities." ); script_set_attribute(attribute:"description", value: "The version of QuickTime installed on the remote Mac OS X host is older than 7.5.5. Such versions contain several vulnerabilities : - Heap and stack-based buffer overflows in the handling of panorama atoms in QTVR (QuickTime Virtual Reality) movie files could lead to an application crash or arbitrary code execution (CVE-2008-3624 and CVE-2008-3625). - A memory corruption issue in QuickTime's handling of STSZ atoms in movie files could lead to an application crash or arbitrary code execution (CVE-2008-3626). - Multiple memory corruption issues in QuickTime's handling of H.264-encoded movie files could lead to an application crash or arbitrary code execution (CVE-2008-3627). - An out-of-bounds read issue in QuickTime's handling of PICT images could lead to an application crash (CVE-2008-3629)." ); script_set_attribute(attribute:"see_also", value:"http://support.apple.com/kb/HT3027" ); script_set_attribute(attribute:"see_also", value:"http://lists.apple.com/archives/security-announce/2008/Sep/msg00000.html" ); script_set_attribute(attribute:"solution", value: "Either use QuickTime's Software Update preference to upgrade to the latest version or manually upgrade to QuickTime 7.5.5 or later." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_cwe_id(119, 399); script_set_attribute(attribute:"plugin_publication_date", value: "2008/09/10"); script_set_attribute(attribute:"patch_publication_date", value: "2008/09/09"); script_cvs_date("Date: 2018/07/14 1:59:35"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:apple:quicktime"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"MacOS X Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2008-2018 Tenable Network Security, Inc."); script_dependencies("macosx_Quicktime652.nasl"); script_require_keys("MacOSX/QuickTime/Version"); exit(0); } # include("global_settings.inc"); ver = get_kb_item("MacOSX/QuickTime/Version"); if (isnull(ver)) exit(0); iver = split(ver, sep:'.', keep:FALSE); for (i=0; i<max_index(iver); i++) iver[i] = int(iver[i]); if ( iver[0] < 7 || ( iver[0] == 7 && ( iver[1] < 5 || (iver[1] == 5 && iver[2] < 5) ) ) ) { if (report_verbosity) { report = string( "\n", "QuickTime ", ver, " is currently installed on the remote host.\n" ); security_hole(port:0, extra:report); } else security_hole(0); }
NASL family Windows NASL id QUICKTIME_755.NASL description The version of QuickTime installed on the remote Windows host is older than 7.5.5. Such versions contain several vulnerabilities : - An integer overflow in QuickTime last seen 2020-06-01 modified 2020-06-02 plugin id 34119 published 2008-09-10 reporter This script is Copyright (C) 2008-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/34119 title QuickTime < 7.5.5 Multiple Vulnerabilities (Windows)
Oval
accepted | 2013-07-29T04:00:36.094-04:00 | ||||||||||||
class | vulnerability | ||||||||||||
contributors |
| ||||||||||||
definition_extensions |
| ||||||||||||
description | The CallComponentFunctionWithStorage function in Apple QuickTime before 7.5.5 does not properly handle a large entry in the sample_size_table in STSZ atoms, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file. | ||||||||||||
family | windows | ||||||||||||
id | oval:org.mitre.oval:def:16152 | ||||||||||||
status | accepted | ||||||||||||
submitted | 2012-12-11T16:37:33.623-05:00 | ||||||||||||
title | The CallComponentFunctionWithStorage function in Apple QuickTime before 7.5.5 does not properly handle a large entry in the sample_size_table in STSZ atoms, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file | ||||||||||||
version | 7 |
Seebug
bulletinFamily exploit description BUGTRAQ ID: 31546 CVE ID:CVE-2008-3626 CNCVE ID:CNCVE-20083626 Apple QuickTime是一款流行的媒体处理程序。 Apple QuickTime处理特殊构建的媒体文件存在问题,远程攻击者可以利用漏洞进行缓冲区溢出,可导致以应用程序权限执行任意指令。 问题存在于CallComponentFunctionWithStorage()函数中对STSZ atoms的处理,当sample_size_table中的条目过大时,可触发内存破坏,可能以当前用户上下文执行任意指令。 Apple TV 2.1 Apple TV 2.0 Apple TV 1.1 Apple TV 1.0 Apple QuickTime Player 7.4.5 + Apple Mac OS X 10.4.9 + Apple Mac OS X 10.3.9 + Apple Mac OS X 10.5 + Apple Mac OS X Server 10.4.9 + Apple Mac OS X Server 10.3.9 + Apple Mac OS X Server 10.5 Apple QuickTime Player 7.4.1 Apple QuickTime Player 7.3.1 .70 Apple QuickTime Player 7.3.1 Apple QuickTime Player 7.1.6 Apple QuickTime Player 7.1.5 Apple QuickTime Player 7.1.4 Apple QuickTime Player 7.1.3 Apple QuickTime Player 7.1.2 Apple QuickTime Player 7.1.1 Apple QuickTime Player 7.0.4 Apple QuickTime Player 7.0.3 Apple QuickTime Player 7.0.2 Apple QuickTime Player 7.0.1 Apple QuickTime Player 7.0 Apple QuickTime Player 7.5 Apple QuickTime Player 7.4 Apple QuickTime Player 7.4 Apple QuickTime Player 7.3 Apple QuickTime Player 7.2 Apple QuickTime Player 7.1 可参考如下补丁: Apple QuickTime Player 7.5 Apple QuickTime755_Leopard.dmg <a href=http://www.apple.com/quicktime/download/ target=_blank>http://www.apple.com/quicktime/download/</a> Apple QuickTime755_Tiger.dmg <a href=http://www.apple.com/quicktime/download/ target=_blank>http://www.apple.com/quicktime/download/</a> Apple QuickTimeInstaller.exe <a href=http://www.apple.com/quicktime/download/ target=_blank>http://www.apple.com/quicktime/download/</a> id SSV:4165 last seen 2017-11-19 modified 2008-10-08 published 2008-10-08 reporter Root title Apple QuickTime 'STSZ' Atoms内存破坏漏洞 bulletinFamily exploit description BUGTRAQ ID: 31086 CVE ID:CVE-2008-3615 CVE-2008-3635 CVE-2008-3624 CVE-2008-3625 CVE-2008-3614 CVE-2008-3626 CVE-2008-3627 CVE-2008-3628 CVE-2008-3629 CNCVE ID:CNCVE-20083615 CNCVE-20083635 CNCVE-20083624 CNCVE-20083625 CNCVE-20083614 CNCVE-20083626 CNCVE-20083627 CNCVE-20083628 CNCVE-20083629 Apple QuickTime是一款苹果公司发布的媒体播放程序。 Apple QuickTime处理多种媒体文件多个安全问题,远程攻击者可以利用漏洞对应用程序进行拒绝服务或任意代码执行攻击。 CVE-2008-3627: Apple QuickTime处理AVC1 atoms存在整数溢出,可导致任意代码执行。 CVE-2008-3635: 利用Indeo video codec对QuickTime文件解析存在缺陷,QuickTimeInternetExtras.qtx中的不正确边界检查可导致基于堆栈的缓冲区溢出,可导致任意代码执行。 CVE-2008-3627: QuickTimeH264.scalar对mov视频文件存在缺陷,特殊构建的MDAT atom可导致堆破坏。 CVE-2008-3625: 处理全景跟踪PDAT atoms存在缺陷,当maxTilt, minFieldOfView和maxFieldOfView元素被破坏时,可导致基于栈的缓冲区溢出。 CVE-2008-3627: QuickTimeH264.qtx中的MP4视频文件处理存在缺陷,特殊构建的MDAT ATOM存在堆破坏漏洞。 CVE-2008-3626: CallComponentFunctionWithStorage()函数处理STSZ atoms存在缺陷,sample_size_table条目过大时可导致内存破坏。 CVE-2008-3624: 处理特殊构建的QTVR文件存在堆缓冲区溢出,可导致任意代码执行。 CVE-2008-3628: 处理特殊构建的PICT映像文件存在非法指针问题,可导致拒绝服务或者任意代码执行攻击。 Apple QuickTime Player 7.4.5 + Apple Mac OS X 10.4.9 + Apple Mac OS X 10.3.9 + Apple Mac OS X 10.5 + Apple Mac OS X Server 10.4.9 + Apple Mac OS X Server 10.3.9 + Apple Mac OS X Server 10.5 Apple QuickTime Player 7.4.1 Apple QuickTime Player 7.3.1 .70 Apple QuickTime Player 7.3.1 Apple QuickTime Player 7.1.6 Apple QuickTime Player 7.1.5 Apple QuickTime Player 7.1.4 Apple QuickTime Player 7.1.3 Apple QuickTime Player 7.1.2 Apple QuickTime Player 7.1.1 Apple QuickTime Player 7.0.4 Apple QuickTime Player 7.0.3 Apple QuickTime Player 7.0.2 Apple QuickTime Player 7.0.1 Apple QuickTime Player 7.0 Apple QuickTime Player 7.5 Apple QuickTime Player 7.4 Apple QuickTime Player 7.4 Apple QuickTime Player 7.3 Apple QuickTime Player 7.2 Apple QuickTime Player 7.1 升级到最新版本: Apple QuickTime Player 7.5 Apple iTunes8Setup.exe <a href=http://www.apple.com/quicktime/download/ target=_blank>http://www.apple.com/quicktime/download/</a> Apple QuickTime755_Leopard.dmg <a href=http://www.apple.com/quicktime/download/ target=_blank>http://www.apple.com/quicktime/download/</a> Apple QuickTime755_Tiger.dmg <a href=http://www.apple.com/quicktime/download/ target=_blank>http://www.apple.com/quicktime/download/</a> Apple QuickTimeInstaller.exe <a href=http://www.apple.com/quicktime/download/ target=_blank>http://www.apple.com/quicktime/download/</a> id SSV:4026 last seen 2017-11-19 modified 2008-09-11 published 2008-09-11 reporter Root title Apple QuickTime Movie/PICT/QTVR多个远程漏洞
References
- http://lists.apple.com/archives/security-announce//2008/Sep/msg00000.html
- http://lists.apple.com/archives/security-announce/2008/Oct/msg00000.html
- http://marc.info/?l=bugtraq&m=122099929821288&w=2
- http://secunia.com/advisories/31821
- http://secunia.com/advisories/32121
- http://securitytracker.com/id?1020841
- http://support.apple.com/kb/HT3027
- http://support.apple.com/kb/HT3189
- http://www.securityfocus.com/bid/31086
- http://www.securityfocus.com/bid/31546
- http://www.vupen.com/english/advisories/2008/2527
- http://www.vupen.com/english/advisories/2008/2735
- http://www.zerodayinitiative.com/advisories/ZDI-08-059/
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16152