QuickTime 0day for Vista and XP
A remote vulnerability exists in the QuickTime player for Windows XP and Vista (latest service packs). Other versions are believed to be affected as well. For now, no details will be released regarding the method of exploitation.
Because we are an information security think tank and because we encounter some very interesting vulnerabilities in our work, we often share our findings with the masses in order to give something back to the community. It is good to take but it is even better when you give. Unfortunately, the situation in UK is changing and we, as whitehat hackers, have to adjust to these changes. Therefore, we have been experimenting with a number of disclosure methods in the past couple of months. We’ve tried everything, from full-disclosure to partial-disclosure, private-disclosure and no disclosure at all. Now is time to move to something totally different and if we find it working for us, we will share the secret with you for the better of the community. Please bare with us. This is just one of our social experiments.
A remote vulnerability exists in the QuickTime player for Windows XP and Vista (latest service packs). An attacker could exploit the vulnerability by constructing a specially crafted QuickTime supported media file that allows remote code execution if a user visited a malicious Web site, opened a specially crafted attachment in e-mail or opened a maliciously crafted media file from the desktop.
If a user is logged on with administrative privalages, the attacker could take complete control of an affected system. An attacker could then install malicious programs, view, change, delete sensitive data, or create new accounts with full user rights. Users who are logged on with less privileged account could be less impacted than users who operate with administrative user rights.
The vulnerability was successfully tested in Windows XP SP2 and Windows Vista SP1 environments. Other versions are believed to be exploitable as well. The vulnerability is currently held private. The GNUCITIZEN team is following responsible disclosure practices. Therefore, the vulnerability details will be privately disclosed to the vendor in a short period of time. This advisory is meant to inform the public and raise the consumer’s awareness.
The video above demonstrates the issue on Windows Vista and Windows XP. The Windows Vista demo is rather slow because it runs from a 512MB VMWare station.
Comments
Wow, impressive. You stumbled upon this doing what? How we can help prevent against this sort of vulnerability?
Nice work PDP, very interesting find. I look forward to reading the information behind this technique in the future.
Also more about the music artist and title names, please :)
good stuff pdp! I must say you’re really inspiring me to find a client-side RCE vuln!
This is simply amazing. I was just thinking, what if someone found this vulnerability and decided to embed the file on a malicious website. Then infect a few larger websites with a hidden iframe including the site. Would hit pretty hard i think.
YouTube must not like your exploit:
“We’re sorry, this video is no longer available.”
I don’t know the name of the song because I took it from a site providing CCed audio. So, I have no idea. rob, the video is still up.
Jonas, that’s why we don’t disclose the details of the issue. We want to inform and at the same time prevent mass 0wnage.
Music is from the swordfish soundtrack….
Dope Smugglaz - The Word (PMT Remix)
pdp, would you name the site or give a link to the track used? Thanks!
Cool… :)
Good - not to post the “exploit” now, but to mention the standard fact: don’t work as Admin.
I like the whitehead way: no destruction, but construction. That’s the right way. You’re sweet as!
Is only the stand-alone player affected or is it exploitable through a browser as well?
Thank you Keve! Sorry for the OT.
Don’t you have to give credit to the person who made the music, even if it is creative commons licensed? I don’t remember seeing a CC license where you don’t have to give credit to the author, though I might not be up to date :)
well, I should have, but if I only knew the author. however, this is irrelevant to the current subject. stay focused. :)
What about Vista w/ UAC turned on? Cool video, nicely produced.
Jim, exploits are means to an end. :) I would be more worried for my online accounts getting compromised, as I don’t have control over them, then my Vista box being included in a harmless botnet.
And how is this remote vulnerability? You click on bloody local file and run it in your local application. Tricks doesn’t make this vulnerability remote.
remote in a sense that the user can be compromised when opening such a file.
Nice one Petko, if you say it is so I trust you,after the PDF thing my faith is almost religious, is there a workaround to prevent this, or just disable Quicktime, any advice? ;>}
This wouldn’t happen to be exploited in a similar fashion to the Windows Media Player one would it?
no details regarding the vulnerability will be shared at this stage. 10x
Nice find, yet again :)
Why do I keep forgetting that you are based in the UK? You’re just a small Viking raid away.
So, probably some URL protocol vulnerability. Or, embedded HTML with an object tag that points the codeBase attribute on mspaint or notepad in known locations. Am I getting close? ;)
/Thor
yeh, if you are around London we should catch up.
UAC is a joke and can be circumvented by savvy programmers.
http://developers.slashdot.org.....27/2013215
there you go, thanks Jim
@jim: rtfa next time. Or at least the comments on /.
For the “imaginary vulnerabilities” Apple’s policy stinks, that’s all I can say…
I think we sometimes forget our roots as security researchers. The only reason we have an industry today was because of full-disclosure and hype. If you can’t create a noise to motivate change, then you don’t affect the commercial market, which in turn means we are all out of jobs ;)
@PDP: Which Class of Vulnerability ( stack/heap based buffer overflow or other.. ) was used for this vulnerability? btw: good work pdp :)
Very good findings and research pdp, keep up the good work, and props for the responsible disclosure. Don’t let any of these trolls take away from your execlent findings. And good luck working with Apple, I just keep thinking about the wireless dirver vulnerability and how they treated HDMoore :\
@alino: I doubt he is going to say, read the other comments and his responses.
so you are doing some HREF track ninja?
http://www.apple.com/quicktime.....racks.html
You test this stuff on a mac PDP?
when can we expect to see how this is done?
Inquiring minds want to know. Can you at least let us know how Apple is reacting to this exploit?
Seconding Jim’s question. Knowing it exists is important, knowing what’s being done about it is even more important.