Quick on the heels of QuickTime being given the dubious honor of being named one of the year’s 12 scariest applications, Apple has posted security advisories for seven vulnerabilities in the media player, all of which could allow attackers to execute random code on vulnerable systems.
QuickTime is a widely used plug-in for Web browsers running on Mac OS or Windows operating systems.
Symantec reported that there are no exploits out for those seven flaws. But on Nov. 6, Symantec also updated one of its Deep Sight security alerts regarding yet another bug. This one is an arbitrary script execution weakness when processing QuickTime Media Link files (.qtl). For that, proof-of-concept exploit code was first made available in January, with yet more proof-of-concept code coming from security researcher Aviv Raff in September.
Symantec said that .qtl files, which are written in XML, can be opened if the file name includes any of these extensions: .qtl, .mp3, .mp4, .m4a, .mov, .avi or .asf.
Script code contained in the “qtnext” parameter of XML “embed” tags of QuickTime Media Link files will be executed by the application. An attacker could trick a victim into opening a rigged file to execute arbitrary code and to possibly load local content in the user’s browser.
Symantec noted that the .qtl flaw doesn’t pose a direct security threat but can be used to help with further attacks.
Proof-of-concept QuickTime Media Link files are available that use the .mp3 file extension from security researchers Petko D. Petkov—aka pdp of gnucitizen.org—and Aviv Raff.
As for the QuickTime flaws Apple has patched, two have to do with the way QuickTime handles image description atoms. The first is a memory corruption problem, while the second is a heap buffer overflow in QuickTime Player’s handling of STSD (Sample Table Sample Descriptor) atoms. With either vulnerability, an attacker could lure a victim into opening a maliciously crafted movie file and then cause the application to crash or could execute code on the targeted system.
A third problem involves multiple vulnerabilities in QuickTime for Java that could allow untrusted Java applets to obtain elevated privileges. By luring a victim to a Web page containing a rigged Java applet, an attacker could force disclosure of sensitive information and could execute arbitrary code with elevated privileges.
The fourth vulnerability is a stack buffer overflow in QuickTime’s PICT image processing. An attacker could exploit this flaw by tricking a victim into opening a rigged image, again leading the application to quit or to the attacker gaining the power to execute code.
Problem No. 5 is a heap buffer overflow, once again in QuickTime’s PICT image processing, once again exploitable if an attacker lures a user into opening a maliciously crafted image. An attacker who exploits the heap buffer overflow again could cause the application to quit or could execute code on the vulnerable system.
There’s another heap buffer overflow, this one in QuickTime’s handling of panorama sample atoms in QTVR (QuickTime Virtual Reality) movie files. An attacker can set up a rigged QTVR file that can cause the application to quit or which can give the attacker the ability to run code on the targeted system.
Yet another heap buffer overflow has been found in QuickTime’s parsing of the color table atom when opening a movie file. By enticing a user to open a maliciously crafted movie file, an attacker may cause an unexpected application termination or arbitrary code execution.
Apple has posted an update for QuickTime 7.3 that can be downloaded automatically via Software Update preferences or downloaded here.
Check out eWEEK.com’s Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK’s Security Watch blog.
