CVE-2012-3752
published 2012-11-09CVE-2012-3752: Multiple buffer overflows in Apple QuickTime before 7.7.3 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via…
PriorityP259critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
36.01%
98.5th percentile
Multiple buffer overflows in Apple QuickTime before 7.7.3 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted style element in a QuickTime TeXML file.
Affected
51 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | quicktime | <= 7.7.2 | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect delivery of crafted QuickTime TeXML files via HTTP response Content-Type header 'application/x-quicktime-texml', especially when the file contains an oversized font-table style field (e.g., 16KB of repeated '1' characters). ↗
- →Look for TeXML files (.3gp extension served with TeXML content) containing a font-table style field with a large payload composed exclusively of bytes 0x31–0x39 ('1'–'9'), indicative of the constrained overflow. ↗
- →Monitor QuickTime processes for suspicious child process creation or migration activity, as the Metasploit module uses 'migrate -f' as InitialAutoRunScript after exploitation. ↗
- →The vulnerable component is QuickTime3GPP.gtx; alert on stack-based buffer overflow indicators (e.g., SEH overwrites, abnormal stack frames) within this DLL when processing style element subfields. ↗
- →The overflow check routine only allows digit characters (0x31–0x39); any font-table, font-size, or line-height field in a TeXML style block containing a long run of digit-only bytes should be treated as suspicious. ↗
- ·The Metasploit module targets only IE 6/7 and Firefox 3.5/3.5.1 on Windows XP/Vista; exploitation against other browsers or OS versions is not supported by this module and will return a 404. ↗
- ·DEP/ASLR bypass is not implemented in this exploit due to the byte restriction (only 0x31–0x39 usable), limiting reliable exploitation to systems without these mitigations. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Apple QuickTime 7.7.2 - TeXML Style Element font-table Field Stack Buffer Overflow (Metasploit)
exploitdb·2012-11-24
CVE-2012-3752 Apple QuickTime 7.7.2 - TeXML Style Element font-table Field Stack Buffer Overflow (Metasploit)
Apple QuickTime 7.7.2 - TeXML Style Element font-table Field Stack Buffer Overflow (Metasploit)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
class Metasploit3 OperatingSystems::WINDOWS,
:javascript => true,
:rank => NormalRanking
})
def initialize(info = {})
super(update_info(info,
'Name' => 'Apple QuickTime 7.7.2 TeXML Style Element font-table Field Stack Buffer Overflow',
'Description' => %q{
This module exploits a vulnerability found in Apple QuickTime. When handling
a TeXML file, it is possible to trigger a stack-based buffer overflow, and then
gain arbitrary code execut
Metasploit
Apple QuickTime 7.7.2 TeXML Style Element font-table Field Stack Buffer Overflow
metasploit
Apple QuickTime 7.7.2 TeXML Style Element font-table Field Stack Buffer Overflow
Apple QuickTime 7.7.2 TeXML Style Element font-table Field Stack Buffer Overflow
This module exploits a vulnerability found in Apple QuickTime. When handling a TeXML file, it is possible to trigger a stack-based buffer overflow, and then gain arbitrary code execution under the context of the user. This is due to the QuickTime3GPP.gtx component not handling certain Style subfields properly, as the font-table field, which is used to trigger the overflow in this module. Because of QuickTime restrictions when handling font-table fields, only 0x31-0x39 bytes can be used to overflow, so at the moment DEP/ASLR bypass hasn't been provided. The module has been tested successfully on IE6 and IE7 browsers (Windows XP and Vista).
No writeups or analysis indexed.
http://lists.apple.com/archives/security-announce/2012/Nov/msg00002.htmlhttp://packetstormsecurity.com/files/118359/Apple-QuickTime-7.7.2-TeXML-Style-Element-font-table-Field-Stack-Buffer-Overflow.htmlhttp://secunia.com/advisories/51226http://support.apple.com/kb/HT5581http://www.securityfocus.com/bid/56557https://exchange.xforce.ibmcloud.com/vulnerabilities/79899https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16121http://lists.apple.com/archives/security-announce/2012/Nov/msg00002.htmlhttp://packetstormsecurity.com/files/118359/Apple-QuickTime-7.7.2-TeXML-Style-Element-font-table-Field-Stack-Buffer-Overflow.htmlhttp://secunia.com/advisories/51226http://support.apple.com/kb/HT5581http://www.securityfocus.com/bid/56557https://exchange.xforce.ibmcloud.com/vulnerabilities/79899https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16121
2012-11-09
Published