Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: Buffer-overflow in Quicktime Player
From: "Marcello Barnaba (void)" <vjt () openssl it>
Date: Thu, 10 Jan 2008 22:39:10 +0100

On Jan 10, 2008, at 7:45 PM, Luigi Auriemma wrote:

For exploiting this vulnerability is only needed that an user follows
a rtsp:// link, if the port 554 of the server is closed Quicktime will
automatically change the transport and will try the HTTP protocol on
port 80, the 404 error message of the server (other error numbers are
valid too) will be visualized in the LCD-like screen.

Tried on QuickTime 7.3.10 running on OSX 10.5.1, and the player doesn't
try to connect to port 80 if 554 is closed.

Either putting nc to listen on port 554 and making QT connect to rtsp:/
or listening on port 80 and connecting to http:/ does not crash it. So,
yeah, the bug should lie somewhere in the "fallback" that QT employs on
Windows when finding out that the rtsp port is closed.

Best regards!

pub 1024D/8D2787EF  723C 7CA3 3C19 2ACE  6E20 9CC1 9956 EB3C 8D27 87EF

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]