A heap overflow vulnerability in Apple Computer Inc.s iTunes and QuickTime media players could put millions of PC and Mac users at risk of malicious hacker attacks, security experts warned Wednesday.
In an advisory posted on Security-Protocols.com, researcher Tom Ferris warned that attackers can rig QuickTime movie files to trigger a denial-of-service crash that may lead to malicious code execution.
In an interview with eWEEK, Ferris said he flagged the issue to Apple more than a month ago but only received a cursory confirmation that the bug was being investigated. As per policy, Apple does not comment on security issues until a patch is available.
Ferris, who uses the online moniker “badpack3t,” rated the risk to Apple customers as “high.” He said the flaw was confirmed on all current and prior versions of Apple iTunes and QuickTime for Mac OS X and Win32.
A proof-of-concept “.mov” file was also released by Ferris to demonstrate the bug that crashes both programs on the “freed ()” object. Ferris, who has been criticized in the past for his approach to vulnerability disclosure, said he has no plans to release exploit code for the Apple bugs.
“The proof-of-concept [.mov files] only trigger the crash, showing the control of memory. I will not publish a full working exploit for this,” Ferris said, before acknowledging that a malicious hacker had enough information to craft a successful attack.
Security alerts aggregator Secunia Inc. has slapped a “moderately critical” rating on the vulnerability and warned iTunes and QuickTime users to avoid opening “.mov” files from untrusted sources.
The Ferris discovery is not the first QuickTime/iTunes bug that remains unpatched. eEye Digital Security, a research outfit based in Aliso Viejo, Calif., lists three high-risk Apple flaws on its upcoming advisories Web page.
A spokesman for eEye said the vulnerabilities could be exploited remotely to launch executable code but noted that a successful attack requires some user action.
In November, Apple shipped a new version of QuickTime to protect against “highly critical” system access and denial-of-service vulnerabilities.
That upgrade covered four different flaws, including an integer overflow error in the handling of a “Pascal” style string when loading a “.mov” video file.
This can result in memory overwrite due to a large memory copy, potentially allowing arbitrary code execution via a specially crafted video file.