what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Apple QuickTime TeXML Stack Buffer Overflow

Posted Jun 29, 2012

Authored by sinn3r, Alexander Gavrun, juan vazquez | Site metasploit.com

This Metasploit module exploits a vulnerability found in Apple QuickTime. When handling a TeXML file, it is possible to trigger a stack-based buffer overflow, and then gain arbitrary code execution under the context of the user. The flaw is generally known as a bug while processing the 'transform' attribute, however, that attack vector seems to only cause a TerminateProcess call due to a corrupt stack cookie, and more data will only trigger a warning about the malformed XML file. This Metasploit module exploits the 'color' value instead, which accomplishes the same thing.

tags | exploit, overflow, arbitrary, code execution

systems | apple

advisories | CVE-2012-0663, OSVDB-81934

SHA-256 | c3e73b5fb622e5d0d8dee9cca23a811ec375673bedd92228a5733bc9287c407b

Download | Favorite | View

Related Files

No related files