CVE-2011-0257
published 2011-08-15CVE-2011-0257: Integer signedness error in Apple QuickTime before 7.7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a…
PriorityP260critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
60.11%
99.0th percentile
Integer signedness error in Apple QuickTime before 7.7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PnSize opcode in a PICT file that triggers a stack-based buffer overflow.
Affected
32 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | quicktime | <= 7.6.9 | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff
bytes↗
\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff
- →Exploit targets a crafted PnSize opcode ($0007) in a PICT file embedded in a .mov container; look for .mov files containing PICT data with anomalous PnSize (opcode 0x0007) values triggering a stack-based buffer overflow in QuickTime. ↗
- →Exploit payload uses AlphanumUpper encoder with ECX as BufferRegister; network or file-based detection should look for all-uppercase alphanumeric shellcode blobs (~750 bytes) preceded by the prepend stub \xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff inside .mov/PICT files. ↗
- →SEH overwrite occurs at offset 2302 within the trigger buffer (3324 bytes total); the SEH handler is overwritten with the return address at offset 2302 and payload begins at offset 2310. ↗
- →For the Windows XP SP3 target, the SEH overwrite uses the fixed return address 0x672b6d4a from QuickTime.qts version 7.60.92.0; presence of this address in a .mov file is a strong indicator of exploitation. ↗
- →The QQPLAYER variant uses a ROP chain for DEP/ASLR bypass on Windows 7; the stack pivot address 0x67664cde and ROP gadgets from QQPlayer.exe and avutil-49.dll (e.g., 0x63d05001) inside a .mov file indicate exploitation of this variant. ↗
- →The malicious .mov file is constructed by appending a crafted overflow buffer to a base CVE-2011-0257.mov template file; detection should flag .mov files whose trailing data contains large uppercase-alphanumeric blocks or SEH/ROP gadget sequences. ↗
- ·The Metasploit module targets only Apple QuickTime Player version 7.60.92.0 on Windows XP SP3; the return address 0x672b6d4a is specific to QuickTime.qts at that exact version and will not work on other versions or platforms. ↗
- ·The QQPLAYER variant (exploit-db 18137) targets QQPLAYER 3.2 (build 32_845) on Windows 7 with a ROP-based DEP+ASLR bypass; the ROP gadget addresses are hardcoded to that specific build and may not be reliable across other builds. ↗
- ·Payload space is constrained to 750 bytes and BadChars is empty (memcpy-based copy), meaning the encoder must produce alphanumeric-upper output; payloads exceeding 750 bytes or containing non-alphanumeric bytes will fail. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
QQPLAYER Player 3.2 - PICT PnSize Buffer Overflow Windows (ASLR + DEP Bypass) (Metasploit)
exploitdb·2011-11-21
CVE-2011-5006 QQPLAYER Player 3.2 - PICT PnSize Buffer Overflow Windows (ASLR + DEP Bypass) (Metasploit)
QQPLAYER Player 3.2 - PICT PnSize Buffer Overflow Windows (ASLR + DEP Bypass) (Metasploit)
---
# Exploit Title: QQPLAYER PICT PnSize Buffer Overflow WIN7 DEP_ASLR BYPASS
# Date: 2011,11,21
# Author: hellok
# Software Link: http://dl_dir.qq.com/invc/qqplayer/QQPlayer_Setup_32_845.exe
# Version: 32_845(lastest)
# Tested on: WIN7
require 'msf/core'
class Metasploit3 'QQPLAYER PICT PnSize Buffer Overflow WIN7 DEP_ASLR BYPASS',
'Description' => %q{
This module exploits a vulnerability in QQPLAYER Player 3.2.
When opening a .mov file containing a specially crafted PnSize value, an attacker
may be able to execute arbitrary code.
},
'License' => MSF_LICENSE,
'Author' =>
[
'hellok', #special thank corelanc0d3r for 'mona'
],
'References' =>
[
],
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
'Disa
Exploit-DB
Apple QuickTime - PICT PnSize Buffer Overflow (Metasploit)
exploitdb·2011-09-03
CVE-2011-0257 Apple QuickTime - PICT PnSize Buffer Overflow (Metasploit)
Apple QuickTime - PICT PnSize Buffer Overflow (Metasploit)
---
##
# $Id: apple_quicktime_pnsize.rb 13691 2011-09-03 21:17:58Z mc $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Apple QuickTime PICT PnSize Buffer Overflow',
'Description' => %q{
This module exploits a vulnerability in Apple QuickTime Player 7.60.92.0.
When opening a .mov file containing a specially crafted PnSize value, an attacker
may be able to execute arbitrary code.
},
'License' => MSF_LICENSE,
'Author' => [ 'MC' ],
'Version' => '$Revision: 13691 $',
'References' =>
[
[
Metasploit
Apple QuickTime PICT PnSize Buffer Overflow
metasploit
Apple QuickTime PICT PnSize Buffer Overflow
Apple QuickTime PICT PnSize Buffer Overflow
This module exploits a vulnerability in Apple QuickTime Player 7.60.92.0. When opening a .mov file containing a specially crafted PnSize value, an attacker may be able to execute arbitrary code.
No writeups or analysis indexed.
http://securityreason.com/securityalert/8365http://support.apple.com/kb/HT4826http://www.exploit-db.com/exploits/17777http://zerodayinitiative.com/advisories/ZDI-11-252/https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16059http://securityreason.com/securityalert/8365http://support.apple.com/kb/HT4826http://www.exploit-db.com/exploits/17777http://zerodayinitiative.com/advisories/ZDI-11-252/https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16059
2011-08-15
Published