CVE-2010-1818
published 2010-08-31CVE-2010-1818: The IPersistPropertyBag2::Read function in QTPlugin.ocx in Apple QuickTime 6.x, 7.x before 7.6.8, and other versions allows remote attackers to execute…
PriorityP266critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
42.67%
98.6th percentile
The IPersistPropertyBag2::Read function in QTPlugin.ocx in Apple QuickTime 6.x, 7.x before 7.6.8, and other versions allows remote attackers to execute arbitrary code via the _Marshaled_pUnk attribute, which triggers unmarshalling of an untrusted pointer.
Affected
47 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect HTML pages embedding a QuickTime ActiveX object with a '_Marshaled_pUnk' parameter — this is the trigger attribute for CVE-2010-1818 exploitation. ↗
- →The exploit uses heap spray targeting address 0x15220c20; memory forensics or crash dumps showing EIP/EAX at or near 0x15220c20 are indicative of this exploit. ↗
- →The Metasploit module uses a ROP chain anchored to QuickTimeAuthoring.qtx (base 0x677a0000) to bypass DEP/ASLR; presence of this module loaded at that base in a browser process is suspicious. ↗
- →The exploit payload uses 'migrate -f' as InitialAutoRunScript (Meterpreter process migration); detect unexpected process spawning from iexplore.exe or browser processes shortly after QuickTime ActiveX instantiation. ↗
- →Crash signature: access violation with EIP=0xdeadbe01 or EIP=0xdeadbeef in the context of a browser process loading QTPlugin.ocx indicates exploitation attempt or testing. ↗
- ·ROP gadget offsets and the heap spray target address (0x15220c20) are specific to QuickTime 7.6.6 and 7.6.7 on Windows XP SP3; addresses will differ for other versions. ↗
- ·QuickTimeAuthoring.qtx in version 7.6.7 is compiled with DYNAMIC_BASE (ASLR-enabled), making the ROP chain unreliable on Windows 7 with that version. ↗
- ·The exploit was reported not to work on QuickTime 7.6.5 because QuickTimeAuthoring.qtx changed and ROP gadgets differ. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Apple QuickTime 7.6.7 - _Marshaled_pUnk Code Execution (Metasploit)
exploitdb·2011-01-08
CVE-2010-1818 Apple QuickTime 7.6.7 - _Marshaled_pUnk Code Execution (Metasploit)
Apple QuickTime 7.6.7 - _Marshaled_pUnk Code Execution (Metasploit)
---
##
# $Id: apple_quicktime_marshaled_punk.rb 11513 2011-01-08 00:25:44Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 OperatingSystems::WINDOWS,
:javascript => true,
:rank => NormalRanking, # reliable memory corruption
:vuln_test => nil,
})
def initialize(info = {})
super(update_info(info,
'Name' => 'Apple QuickTime 7.6.7 _Marshaled_pUnk Code Execution',
'Description' => %q{
This module exploits a memory trust issue in Apple QuickTime
7.6.7. When processing a s
Exploit-DB
Apple QuickTime - '_Marshaled_pUnk' Backdoor Client-Side Arbitrary Code Execution
exploitdb·2010-08-30
CVE-2010-1818 Apple QuickTime - '_Marshaled_pUnk' Backdoor Client-Side Arbitrary Code Execution
Apple QuickTime - '_Marshaled_pUnk' Backdoor Client-Side Arbitrary Code Execution
---
Original Source: http://reversemode.com/index.php?option=com_content&task=view&id=69&Itemid=1
Victim prerequisites:
* Internet Explorer.
* XP,Vista,W7.
* Apple Quicktime 7.x, 6.x ( 2004 versions are also vulnerable, older versions not checked )
1. Victim is enticed into visiting, by any mean, a specially crafted webpage.
2. Attacker's payload to be executed under the context of the browser.
3. Attacker calls his girlfriend to inform about the successful exploitation, who indeed turns out to be very interested in the issue. She demands more technical details.
4. Attacker wakes up.
Technical details
QTPlugin.ocx implements IPersistPropertyBag2::Read (1000E330) to handle params received from where it
Metasploit
Apple QuickTime 7.6.7 _Marshaled_pUnk Code Execution
metasploit
Apple QuickTime 7.6.7 _Marshaled_pUnk Code Execution
Apple QuickTime 7.6.7 _Marshaled_pUnk Code Execution
This module exploits a memory trust issue in Apple QuickTime 7.6.7. When processing a specially-crafted HTML page, the QuickTime ActiveX control will treat a supplied parameter as a trusted pointer. It will then use it as a COM-type pUnknown and lead to arbitrary code execution. This exploit utilizes a combination of heap spraying and the QuickTimeAuthoring.qtx module to bypass DEP and ASLR. This module does not opt-in to ASLR. As such, this module should be reliable on all Windows versions. NOTE: The addresses may need to be adjusted for older versions of QuickTime.
No writeups or analysis indexed.
http://lists.apple.com/archives/security-announce/2010/Sep/msg00003.htmlhttp://reversemode.com/index.php?option=com_content&task=view&id=69&Itemid=1http://support.apple.com/kb/ht4339http://threatpost.com/en_us/blogs/new-remote-flaw-apple-quicktime-bypasses-aslr-and-dep-083010https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7523https://www.metasploit.com/redmine/projects/framework/repository/entry/modules/exploits/windows/browser/apple_quicktime_marshaled_punk.rbhttp://lists.apple.com/archives/security-announce/2010/Sep/msg00003.htmlhttp://reversemode.com/index.php?option=com_content&task=view&id=69&Itemid=1http://support.apple.com/kb/ht4339http://threatpost.com/en_us/blogs/new-remote-flaw-apple-quicktime-bypasses-aslr-and-dep-083010https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7523https://www.metasploit.com/redmine/projects/framework/repository/entry/modules/exploits/windows/browser/apple_quicktime_marshaled_punk.rb
2010-08-31
Published