CVE-2012-0663
published 2012-05-16CVE-2012-0663: Multiple stack-based buffer overflows in Apple QuickTime before 7.7.2 on Windows allow remote attackers to execute arbitrary code or cause a denial of service…
PriorityP259critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
28.62%
97.9th percentile
Multiple stack-based buffer overflows in Apple QuickTime before 7.7.2 on Windows allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TeXML file.
Affected
64 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | quicktime | <= 7.7.1 | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
BadChars: \x00\x23\x25\x3c\x3e\x7d
- →The exploit triggers the overflow via the 'color' value in a TeXML Style element, not the 'transform' attribute. Detection should focus on malformed XML files with oversized 'color' field values in TeXML Style subfields. ↗
- →The 'transform' attribute attack vector causes a TerminateProcess call due to a corrupt stack cookie; a crash of QuickTime on a TeXML file with a corrupt stack cookie may indicate an attempted but failed exploit via the transform vector. ↗
- →The overflow buffer offset is 643 bytes with a maximum payload size of 13508 bytes. Payloads in the 'color' field of a TeXML Style element exceeding 643 bytes should be treated as suspicious. ↗
- →The vulnerable component is QuickTime3GPP.gtx. Monitor for crashes or anomalous behavior originating from this DLL when processing XML/TeXML files. ↗
- →The exploit payload is embedded in the TeXML 'color' CSS-style attribute value within a {color: ...%, 100%, 100%, 100%} construct. Hunt for TeXML/XML files containing abnormally long color style values. ↗
- ·The ROP gadget addresses (Ret values) are specific to exact QuickTime.qts build versions (7.71.80.42, 7.70.80.34, 7.69.80.9) on Windows XP SP3. These addresses will differ on other OS versions or QuickTime builds, limiting direct reuse of these gadgets. ↗
- ·The exploit targets Windows platform only; the TeXML vulnerability as exploited here is scoped to Apple QuickTime on Windows. ↗
- ·NOP sleds are disabled in the payload configuration, meaning standard NOP-sled detection signatures will not fire on this exploit's shellcode. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Apple QuickTime - TeXML Stack Buffer Overflow (Metasploit)
exploitdb·2012-06-28
CVE-2012-0663 Apple QuickTime - TeXML Stack Buffer Overflow (Metasploit)
Apple QuickTime - TeXML Stack Buffer Overflow (Metasploit)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
class Metasploit3 'Apple QuickTime TeXML Stack Buffer Overflow',
'Description' => %q{
This module exploits a vulnerability found in Apple QuickTime. When handling
a TeXML file, it is possible to trigger a stack-based buffer overflow, and then
gain arbitrary code execution under the context of the user. The flaw is
generally known as a bug while processing the 'transform' attribute, however,
that attack vector seems to only cause a TerminateProcess call due to a corrupt
stac
Metasploit
Apple QuickTime TeXML Style Element Stack Buffer Overflow
metasploit
Apple QuickTime TeXML Style Element Stack Buffer Overflow
Apple QuickTime TeXML Style Element Stack Buffer Overflow
This module exploits a vulnerability found in Apple QuickTime. When handling a TeXML file, it is possible to trigger a stack-based buffer overflow, and then gain arbitrary code execution under the context of the user. This is due to the QuickTime3GPP.gtx component not handling certain Style subfields properly, storing user-supplied data on the stack, which results the overflow.
No writeups or analysis indexed.
http://lists.apple.com/archives/security-announce/2012/May/msg00005.htmlhttp://support.apple.com/kb/HT5261http://www.securityfocus.com/bid/53571http://www.securitytracker.com/id?1027065https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16006http://lists.apple.com/archives/security-announce/2012/May/msg00005.htmlhttp://support.apple.com/kb/HT5261http://www.securityfocus.com/bid/53571http://www.securitytracker.com/id?1027065https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16006
2012-05-16
Published