Slashdot Mirror
New QuickTime Flaw Bypasses ASLR, DEP
Trailrunner7 writes "A Spanish security researcher has discovered a new vulnerability in Apple's QuickTime software that can be used to bypass both ASLR and DEP on current versions of Windows and give an attacker control of a remote PC. The flaw apparently results from a parameter from an older version of QuickTime that was left in the code by mistake. It was discovered by Ruben Santamarta of Wintercore, who said the vulnerability can be exploited remotely via a malicious Web site. On a machine running Internet Explorer on Windows 7, Vista or XP with QuickTime 7.x or 6.x installed, the problem can be exploited by using a heap-spraying technique. In his explanation of the details of the vulnerability and the exploit for it, Santamarta said he believes the parameter at the heart of the problem simply was not cleared out of older versions of the QuickTime code. 'The QuickTime plugin is widely installed and exploitable through IE; ASLR and DEP are not effective in this case and we will likely see this in the wild,' said HD Moore, founder of the Metasploit Project."
People still use that garbage? That's like installing real player.
Can someone please print out and mail this article to Alanis Morissette so she knows what irony is?
From the article: "The result of the problem is the creation of what amounts to a backdoor in the QuickTime code, Santamarta said. 'WATCH OUT! Do not hype this issue beyond it deserves...'"
Looks like we already missed the boat on that one.
I'd say it's almost as widely installed as Adobe Reader. Here's a guesstimate answer as to how many copies there are (numbers are old)
Make sure everyone's vote counts: Verified Voting
I have now uninstalled the Quicktime player. Would Quicktime Alternative be any safer? Seems Apple has had a rash of security issues lately.
This attack doesn't belong to the class of "smashing" attacks ASLR and DEP is designed to prevent. It's like expecting salted passwords to help you defend against misconfigured NFS shares.
Emotions! In your brain!
Just get a Mac. No big deal.
You can turn off the browser plugin.
http://lkml.org/lkml/2005/8/20/95
apple don't have too much interest in supporting their legacy stuff in windows.
hell, i ran a PC based grading system that quicktime update broke on several occasions. i've had to roll back quicktime installs more than a few times.
but if they do consider fixing this, while they've got everything open, they can look at the colour inaccuracies and implementing a ProRes encoder in windows.
i think this exploit will stay around indefinitely. there's not a mac fanboy in the world who wouldn't say this is actually a windows problem, not an apple one.
Quicktime? Windows?
If you own an iPhone, iPod, or iPad, it's fairly hard to get full advantage of your money.
At first I thought "Ruben Santamarta of Wintercore" was his name. I also considered this awesome.
I've got a mac and I still don't use quicktime. VLC anyone?
I don't like Apple products that much (especially QuickTime and the Shiny iWhatever products) but i fail to see why a grading system would need a Video/Audio decoder.
People love Apple for this stuff, though.
No more screwing around bypassing ASLR or DEP, even the exploit code Just Works.
Successfully created meterpreter session with XP test box but not against 7 box despite what TFA says. Anyone experiencing similar results?
May want to type in the words mac and trojan in a search engine. If you are living under the delusion they don't exist you are the perfect target :-) I guess regardless of platforms there will always be the computer illiterates like yourself that actually believes the dribble sprouted by vendors.
AppleScript-THT
DNSChanger
Trojan.iServices.A
3 I can think of without searching. Ignorance is bliss I guess. I imagine a lot of infected windows users also spout off about how they never get infected so they don't need anti virus.
Why in God's name would you need any ports other than 80 open ?
The only thing you people connect to is *apple.com for your daily dose of Jobsology.
For some reasons I think I would Mod you funny if I had points.
This might have been avoided if MS had a something like the App store for Windows. They could have taken their time before allowing this to be released .... just to be really really sure there something like this wouldn't happen.
I keeed, I keeed .... sorta. :-)
Keep the Classic Slashdot.
ASL, DERP
*sigh*
Great, another 100mb update for a one line bug coming soon.
If a badly-written program can circumvent ASLR and DEP for itself, then aren't DEP and ASLR a bit useless? The point of them is to prevent data execution, and to randomise the address space. How does a badly-written, ancient program "bypass" such measures? I can understand such measures not being applied (e.g. because ASLR or DEP on really-old code would break it because it was written with certain assumptions) but what that then assumes is that some administrator or Microsoft programmer has chosen at some point to disable DEP and ASLR for those old programs (if they have DEP and ASLR enabled at all). And if the code wasn't compiled without some DEP/ASLR magic enabled, then is this really surprising? What's to stop any other program similarly avoiding DEP/ASLR, or anyone exploiting such programs?
How is this a "Quicktime problem" when the code being attacked is years old, and yet the OS still lets it break basic security? Surely the problem is not the program, but the things that let it execute. Hell, I have used old Windows programs that refuse to work with DEP enabled because they make certain assumptions and I realised that because the DEP handler would prevent them working in XP - they were NOT compiled at a time when any knowledge of DEP or ASLR on Windows was around. That's the whole point of DEP, isn't it? To stop programs executing code they shouldn't? I had to force an override for them network-wide but that was my choice, and no I did not specifically enable DEP myself, the Windows XP install decided to do that for me.
Is this version of QuickTime whitelisted? Are DEP and ASLR really that worthless that "old programs" compiled before they came along are allowed to do anything? Isn't this the fault of an administrator running an outdated program rather than anything to do with DEP, ASLR, Quicktime or anything else? What's Quicktime doing differently to every other old, insecure program out there that makes it more of a risk?
Seems like a complete red herring to me. Don't run old software. Don't run insecure software. Don't run programs that you haven't authorised yourself. And, apparently, don't rely on DEP or ASLR to actually DO anything.
Used to be that Quicktime on Windows + MIDI on a web page = quickest way to hang your web browser process. I've no idea if this is still the case because there's no way I'd ever install Quicktime on a Windows ever again, not even to see if it still sucks so bad.
I hate that stupid plug-in, and if it didn't lock up, it made most MIDI files sound like crap. I have a real MIDI synth to play back those files, but Quicktime thinks it isn't good enough.
Shouldn't that be a flaw in Memory Management Unit of the underlying Operating System. And never mind badly-written software, what's to stop anyone in deliberately porgramming in such flaws in order to bypass security.
you fail to see how a color grading system would need an a/v decoder?
I hate that stupid plug-in, and if it didn't lock up, it made most MIDI files sound like crap. I have a real MIDI synth to play back those files, but Quicktime thinks it isn't good enough.
Was the Synth made by Apple? Is it called iSynth? No? Then of course it wasn't good enough!
You do realize that Steve Jobs was going to call the original iMac the MacMan? Yeah. MacMan. Business technologist extraordinare he is, but he's really not good at names.
Make sure everyone's vote counts: Verified Voting
Thapple.
What I don't get is how a flaw in a 3rd party app can be used to bypass the protections at the OS level. Clearly the real problem is deeper than QuickTime.
FTFA:
The gadgets come from Windows Live messenger dlls that are loaded by default on IE and have no ASLR flag.
Wouldn't that be an IE bug at this point that QuickTime is exploiting, not so much a QuickTime bug? I'm not apologizing for Apple not cleaning up their code after they removed a feature (RTFA!), but seems like MS is just as much to blame for this one with the WindowsLive DLL being loaded by default and having no security on it.
Just saying ... if you RTFA and don't just bash QT all day.
Am I missing something here? Apple bashing? Hm seems to the that other programs had this too. Like VLC!! They fixed their program! IT is just not Quick Time! It is so funny reading these post and boy Are there some people here that DON'T READ! JUST BASH! Old version of VLC would be able to do the same thing And Open Office!!! Just sounds like A MS problem not just a Quick Time, Vlc, Openoffice etc...