CVE-2012-3753
published 2012-11-09CVE-2012-3753: Buffer overflow in the plugin in Apple QuickTime before 7.7.3 allows remote attackers to execute arbitrary code or cause a denial of service (application…
PriorityP259critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
35.08%
98.3th percentile
Buffer overflow in the plugin in Apple QuickTime before 7.7.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted MIME type.
Affected
51 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | quicktime | <= 7.7.2 | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
| apple | quicktime | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x81\xc4\x54\xf2\xff\xff
- →The exploit delivers a malformed SMIL file via a URI ending in .smil; detect HTTP responses serving .smil content with a crafted/malformed Content-Type header targeting QuickTime plugin clients. ↗
- →The exploit targets Safari User-Agent strings matching Version/5.1.7 or Version/5.0.5 on Windows; alert on these UA strings combined with .smil resource requests. ↗
- →The stack-based overflow is triggered via a malformed Content-Type header in the SMIL response; monitor for unusually long or malformed MIME type/subtype strings in HTTP Content-Type headers served to QuickTime plugin. ↗
- →The exploit uses a heap spray technique; look for large repetitive JavaScript heap allocations in pages that also embed SMIL/QuickTime objects. ↗
- →Post-exploitation, the Metasploit module auto-runs 'migrate -f' to migrate the process; detect unexpected process migration activity from Safari/QuickTime processes. ↗
- →ROP gadgets in Quicktime.qts at fixed addresses (0x671a230b, 0x67123437) are used for stack pivoting; memory access patterns to these addresses from browser processes may indicate exploitation. ↗
- ·The exploit only targets Windows XP SP3 with Safari 5.1.7 or 5.0.5 and QuickTime 7.7.2; other OS/browser combinations return a 404 and are not exploited by this module. ↗
- ·ROP gadget addresses (FirstStackPivot, SecondStackPivot, SprayedAddress) are hardcoded for QuickTime 7.7.2 on Windows XP SP3; they will not be valid for other QuickTime or OS versions. ↗
- ·JavaScript obfuscation is optional and disabled by default; detections based on static JS signatures may be bypassed if OBFUSCATE is enabled. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Apple QuickTime 7.7.2 - MIME Type Buffer Overflow (Metasploit)
exploitdb·2012-11-28
CVE-2012-3753 Apple QuickTime 7.7.2 - MIME Type Buffer Overflow (Metasploit)
Apple QuickTime 7.7.2 - MIME Type Buffer Overflow (Metasploit)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
class Metasploit3 OperatingSystems::WINDOWS,
:ua_name => HttpClients::SAFARI,
:ua_maxver => '5.0.1',
:ua_maxver => '5.1.7',
:javascript => true,
:rank => NormalRanking, # reliable memory corruption
:vuln_test => nil
})
def initialize(info = {})
super(update_info(info,
'Name' => 'Apple QuickTime 7.7.2 MIME Type Buffer Overflow',
'Description' => %q{
This module exploits a buffer overflow in Apple QuickTime 7.7.2. The stack
based overflow occurs when processing a malform
Metasploit
Apple QuickTime 7.7.2 MIME Type Buffer Overflow
metasploit
Apple QuickTime 7.7.2 MIME Type Buffer Overflow
Apple QuickTime 7.7.2 MIME Type Buffer Overflow
This module exploits a buffer overflow in Apple QuickTime 7.7.2. The stack based overflow occurs when processing a malformed Content-Type header. The module has been tested successfully on Safari 5.1.7 and 5.0.7 on Windows XP SP3.
No writeups or analysis indexed.
http://lists.apple.com/archives/security-announce/2012/Nov/msg00002.htmlhttp://packetstormsecurity.com/files/118421/Apple-QuickTime-7.7.2-MIME-Type-Buffer-Overflow.htmlhttp://secunia.com/advisories/51226http://support.apple.com/kb/HT5581https://exchange.xforce.ibmcloud.com/vulnerabilities/79900https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15947http://lists.apple.com/archives/security-announce/2012/Nov/msg00002.htmlhttp://packetstormsecurity.com/files/118421/Apple-QuickTime-7.7.2-MIME-Type-Buffer-Overflow.htmlhttp://secunia.com/advisories/51226http://support.apple.com/kb/HT5581https://exchange.xforce.ibmcloud.com/vulnerabilities/79900https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15947
2012-11-09
Published