CVE-2010-1799
published 2010-08-16CVE-2010-1799: Stack-based buffer overflow in the error-logging functionality in Apple QuickTime before 7.6.7 on Windows allows remote attackers to execute arbitrary code or…
PriorityP258critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
33.70%
98.2th percentile
Stack-based buffer overflow in the error-logging functionality in Apple QuickTime before 7.6.7 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file.
Affected
52 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect HTTP responses serving SMIL content with Content-Type: application/smil, especially when the User-Agent contains 'QuickTime' or the URI ends in .smil — this matches the exploit delivery mechanism. ↗
- →Look for the error-log trigger string 'cHTTPDhlr_SetURL - url doesn't start with http:// or http1://' in network traffic or process memory; this prefix is prepended to the malformed SMIL URI to trigger the stack overflow. ↗
- →The exploit uses a heap spray via JavaScript alongside a malformed SMIL file delivered to QuickTime; monitor browser processes spawning QuickTime with .smil URI arguments containing oversized (>716 byte) scheme fields. ↗
- →Post-exploitation, the Metasploit module auto-migrates the payload process; monitor for QuickTime.exe or browser processes spawning unexpected child processes shortly after loading SMIL content. ↗
- ·The ROP/p-p-r return address (0x66801042) is specific to QuickTime.qts version 7.66.71.0 only; the exploit targets a single fixed target and will not reliably work against other QuickTime builds. ↗
- ·Payload space is constrained to 640 bytes (716 - 63 - 8 - 5); shellcode exceeding this size will not fit in the overflow buffer. ↗
- ·The vulnerability is Windows-only; Apple QuickTime on other platforms is not affected by this stack overflow in the error-logging path. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Apple QuickTime 7.6.6 - Invalid SMIL URI Buffer Overflow (Metasploit)
exploitdb·2011-01-08
CVE-2010-1799 Apple QuickTime 7.6.6 - Invalid SMIL URI Buffer Overflow (Metasploit)
Apple QuickTime 7.6.6 - Invalid SMIL URI Buffer Overflow (Metasploit)
---
##
# $Id: apple_quicktime_smil_debug.rb 11513 2011-01-08 00:25:44Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 OperatingSystems::WINDOWS,
:javascript => true,
:rank => NormalRanking, # reliable memory corruption
:vuln_test => nil,
})
def initialize(info = {})
super(update_info(info,
'Name' => 'Apple QuickTime 7.6.6 Invalid SMIL URI Buffer Overflow',
'Description' => %q{
This module exploits a buffer overflow in Apple QuickTime
7.6.6. When processing a malf
Metasploit
Apple QuickTime 7.6.6 Invalid SMIL URI Buffer Overflow
metasploit
Apple QuickTime 7.6.6 Invalid SMIL URI Buffer Overflow
Apple QuickTime 7.6.6 Invalid SMIL URI Buffer Overflow
This module exploits a buffer overflow in Apple QuickTime 7.6.6. When processing a malformed SMIL uri, a stack-based buffer overflow can occur when logging an error message.
No writeups or analysis indexed.
http://lists.apple.com/archives/security-announce/2010//Aug/msg00002.htmlhttp://support.apple.com/kb/HT4290http://www.securityfocus.com/bid/41962https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11800http://lists.apple.com/archives/security-announce/2010//Aug/msg00002.htmlhttp://support.apple.com/kb/HT4290http://www.securityfocus.com/bid/41962https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11800
2010-08-16
Published