New QuickTime Flaw Bypasses ASLR, DEP 162
Posted
by
Soulskill
from the once-more-unto-the-breach dept.
from the once-more-unto-the-breach dept.
Trailrunner7 writes "A Spanish security researcher has discovered a new vulnerability in Apple's QuickTime software that can be used to bypass both ASLR and DEP on current versions of Windows and give an attacker control of a remote PC. The flaw apparently results from a parameter from an older version of QuickTime that was left in the code by mistake. It was discovered by Ruben Santamarta of Wintercore, who said the vulnerability can be exploited remotely via a malicious Web site. On a machine running Internet Explorer on Windows 7, Vista or XP with QuickTime 7.x or 6.x installed, the problem can be exploited by using a heap-spraying technique. In his explanation of the details of the vulnerability and the exploit for it, Santamarta said he believes the parameter at the heart of the problem simply was not cleared out of older versions of the QuickTime code. 'The QuickTime plugin is widely installed and exploitable through IE; ASLR and DEP are not effective in this case and we will likely see this in the wild,' said HD Moore, founder of the Metasploit Project."
ew quicktime? (Score:1, Insightful)
Re:Itunes requires quicktime (Score:5, Insightful)
Re:ew quicktime? (Score:3, Insightful)
Is QuickTime really that bad? I understand the objection to "claim all file types", but that's true of all commercial A/V systems. Beyond that, is there anything in particular I should object to about QuickTime, or is it just random Apple hate?
Re:Hold on (Score:3, Insightful)
If a badly-written program can circumvent ASLR and DEP for itself, then aren't DEP and ASLR a bit useless?
In terms of preventing malware from running, no, they're an extra roadblock, but they are certainly not the hardest to overcome.
How does a badly-written, ancient program "bypass" such measures?
By linking the exploit to MS provided software included with Windows that does not use ASLR. From the article, "The gadgets come from Windows Live messenger dlls that are loaded by default on IE and have no ASLR flag,"
The Quicktime problem is that someone can get arbitrary code to try to execute on your box in the first place. That only happens because of the Quicktime flaw.
Are DEP and ASLR really that worthless that "old programs" compiled before they came along are allowed to do anything?
This isn't about old programs. This is the current version of Quicktime. This is about old code in the current version. Code that should never have shipped in the first place. But, until DEP and ASLR are applied to everything that is on a huge number of boxes and/or application level sandboxing or access control becomes robust DEP and ASLR are not very effective.
What's Quicktime doing differently to every other old, insecure program out there that makes it more of a risk?
The Quicktime part of this exploit isn't all that unusual. It's just run of the mill except for being the result of programmers' backdoor shortcut code that should never have gone out in the production release. The bypassing of ASLR in this case, was more interesting to me.
Re:ew quicktime? (Score:3, Insightful)
I guess it's their shitty engineering that makes my computer so stable and operational.
Yeah. Yesterday, I plugged a Mac laptop into a projector. Apparently the Mac needs to reboot after detecting new hardware or something--so it immediately rebooted without prompting, notifying, or even asking me to save. Apple is so awesomely user-friendly. That must be their engineering commitment to build a stable and operational computer.
Anyways--while the mac was busy rebooting, I plugged my linux laptop in. It immediately started working.
Re:ew quicktime? (Score:3, Insightful)
So by you reasoning, all hackers properly implement security features?
Do you even know what ASLR and DEP are? They are not 'features' that an app uses. They are built into the OS. If the OS can be exploited to bypass these then the exposure lies in the OS.
You seem to be missing the disconnect between what your saying and reality. If bypassing OS security was as simple as 'not properly implementing the security features available', then hackers jobs would be all to easy. They could simply opt-out of using things like Virus Scan, Firewalls, Permissions, ASLR, or DEP.
Ummm, question? (Score:3, Insightful)
FTFA:
The gadgets come from Windows Live messenger dlls that are loaded by default on IE and have no ASLR flag.
Wouldn't that be an IE bug at this point that QuickTime is exploiting, not so much a QuickTime bug? I'm not apologizing for Apple not cleaning up their code after they removed a feature (RTFA!), but seems like MS is just as much to blame for this one with the WindowsLive DLL being loaded by default and having no security on it.
Just saying ... if you RTFA and don't just bash QT all day.
Re:ew quicktime? (Score:3, Insightful)
YA ALL MISSING IT!! (Score:2, Insightful)