Secunia

Community Login

Customer Login

Partner Login

Overview

Advisories

Research

Forums

Create Profile

Our Commitment

Database

Advisories by Product

Advisories by Vendor

Terminology

Report Vulnerability

Insecure Library Loading

Secunia Advisory SA41213

Apple QuickTime QTPlugin.ocx Input Validation Vulnerability

Secunia Advisory

SA41213

Release Date

2010-08-31

Last Update

2010-09-16

Popularity

15,806 views

Comments

4 comments

Criticality level

Highly critical

Impact

System access

Where

From remote

Authentication level

Available in Customer Area

Report reliability

Available in Customer Area

Solution Status

Vendor Patch

3rd party PoC/exploit

Link available in Customer Area

Systems affected

Available in Customer Area

Approve distribution

Available in Customer Area

Remediation status

Secunia CSI, Secunia PSI

Automated scanning

Secunia CSI, Secunia PSI

Software:

Apple QuickTime 7.x

Secunia CVSS Score

Available in Customer Area

CVE Reference(s)

CVE-2010-1818 CVSS available in Customer Area

Description

A vulnerability has been discovered in Apple QuickTime, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to the QuickTime ActiveX control (QTPlugin.ocx) using a value passed in the "_Marshaled_pUnk" parameter as a pointer.

Successful exploitation allows execution of arbitrary code.

The vulnerability is confirmed in version 7.6.7 (1675). Other versions may also be affected.

Solution
Update to version 7.6.8.

Provided and/or discovered by
Ruben Santamarta and independently reported by HBelite via ZDI.

Changelog
Further details available in Customer Area

Original Advisory
Apple:
http://support.apple.com/kb/HT4339

Ruben Santamarta:
http://www.reversemode.com/index.php?option=com_content&task=view&id=69&Itemid=1

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-10-168/

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area

Do you have additional information related to this advisory?

Please provide information about patches, mitigating factors, new versions, exploits, faulty patches, links, and other relevant data by posting comments to this Advisory. You can also send this information to vuln@secunia.com

Subject: Apple QuickTime QTPlugin.ocx Input Validation Vulnerability

User

Message

loungehake

RE: Apple QuickTime QTPlugin.ocx Input Validation Vulnerability

31st Aug, 2010 17:30

Score: 1
Posts: 2
User Since: 31st Aug 2010
System Score: N/A
Location: UK
Last edited on 31st Aug, 2010 17:31

If a CLSID is known, it would be very valuable to have it included in the post as a matter of routine so that a kill bit can readily be set.

Was this reply relevant?

-0

SecurityFr3ak

RE: Apple QuickTime QTPlugin.ocx Input Validation Vulnerability

5th Sep, 2010 13:17

Score: 2
Posts: 4
User Since: 31st Aug 2009
System Score: N/A
Location: US
Last edited on 5th Sep, 2010 13:39

The vulnerable ActiveX control can be disabled in Internet Explorer by setting the kill bit for the following Class Identifier (CLSID):

{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}

Further instructions on how to set the kill bit can be found at the following location (http://support.microsoft.com/kb/240797)

http://www.cscic.state.ny.us/advisories/2010/2010-...

http://securitytracker.com/alerts/2010/Aug/1024376...

--
"If you think technology can solve your security problems, then you don't understand the problems and you don't understand the technology."
--Bruce Schneier

Was this reply relevant?

-0

loungehake

RE: Apple QuickTime QTPlugin.ocx Input Validation Vulnerability

5th Sep, 2010 23:04

Score: 1
Posts: 2
User Since: 31st Aug 2010
System Score: N/A
Location: UK
Last edited on 5th Sep, 2010 23:07

That's great. Thanks very much SecurityFr3ak. Such vital information is extraordinarily hard to find if you don't know where to look.

Was this reply relevant?

-0

SecurityFr3ak

RE: Apple QuickTime QTPlugin.ocx Input Validation Vulnerability

6th Sep, 2010 00:40

Score: 2
Posts: 4
User Since: 31st Aug 2009
System Score: N/A
Location: US

No worries. Glad to help out =)

--
"If you think technology can solve your security problems, then you don't understand the problems and you don't understand the technology."
--Bruce Schneier

Was this reply relevant?

-0

Secunia

Secunia Advisory SA41213

Apple QuickTime QTPlugin.ocx Input Validation Vulnerability

Do you have additional information related to this advisory?

You must be logged in to post a comment.

Secunia Customer Login

Not a customer already?