TUCoPS :: Apple(multi)

TUCoPS :: Apple(multi) :: va1205.htm
Apple QuickTime Panorama PDAT Atom Parsing Buffer Overflow Vulnerability
ZDI-08-058: Apple QuickTime Panorama PDAT Atom Parsing Buffer Overflow Vulnerability ZDI-08-058: Apple QuickTime Panorama PDAT Atom Parsing Buffer Overflow Vulnerability

WkRJLTA4LTA1ODogQXBwbGUgUXVpY2tUaW1lIFBhbm9yYW1hIFBEQVQgQXRvbSBQYXJzaW5nIEJ1
ZmZlciBPdmVyZmxvdyANClZ1bG5lcmFiaWxpdHkNCmh0dHA6Ly93d3cuemVyb2RheWluaXRpYXRp
dmUuY29tL2Fkdmlzb3JpZXMvWkRJLTA4LTA1OA0KU2VwdGVtYmVyIDksIDIwMDgNCg0KLS0gQ1ZF
IElEOg0KQ1ZFLTIwMDgtMzYyNQ0KDQotLSBBZmZlY3RlZCBWZW5kb3JzOg0KQXBwbGUNCg0KLS0g
QWZmZWN0ZWQgUHJvZHVjdHM6DQpBcHBsZSBRdWlja3RpbWUNCg0KLS0gVGlwcGluZ1BvaW50KFRN
KSBJUFMgQ3VzdG9tZXIgUHJvdGVjdGlvbjoNClRpcHBpbmdQb2ludCBJUFMgY3VzdG9tZXJzIGhh
dmUgYmVlbiBwcm90ZWN0ZWQgYWdhaW5zdCB0aGlzDQp2dWxuZXJhYmlsaXR5IGJ5IERpZ2l0YWwg
VmFjY2luZSBwcm90ZWN0aW9uIGZpbHRlciBJRCA2MjQyLiANCkZvciBmdXJ0aGVyIHByb2R1Y3Qg
aW5mb3JtYXRpb24gb24gdGhlIFRpcHBpbmdQb2ludCBJUFMsIHZpc2l0Og0KDQogICAgaHR0cDov
L3d3dy50aXBwaW5ncG9pbnQuY29tDQoNCi0tIFZ1bG5lcmFiaWxpdHkgRGV0YWlsczoNClRoaXMg
dnVsbmVyYWJpbGl0eSBhbGxvd3MgcmVtb3RlIGF0dGFja2VycyB0byBleGVjdXRlIGFyYml0cmFy
eSBjb2RlIG9uDQp2dWxuZXJhYmxlIGluc3RhbGxhdGlvbnMgb2YgQXBwbGUgUXVpY2tUaW1lLiBV
c2VyIGludGVyYWN0aW9uIGlzDQpyZXF1aXJlZCB0byBleHBsb2l0IHRoaXMgdnVsbmVyYWJpbGl0
eSBpbiB0aGF0IHRoZSB0YXJnZXQgbXVzdCB2aXNpdCBhDQptYWxpY2lvdXMgcGFnZSBvciBvcGVu
IGEgbWFsaWNpb3VzIGZpbGUuDQoNClRoZSBzcGVjaWZpYyBmbGF3IGV4aXN0cyBpbiB0aGUgaGFu
ZGxpbmcgb2YgcGFub3JhbWEgdHJhY2sgUERBVCBhdG9tcy4NCldoZW4gdGhlIG1heFRpbHQsIG1p
bkZpZWxkT2ZWaWV3IGFuZCBtYXhGaWVsZE9mVmlldyBlbGVtZW50cyBhcmUNCmNvcnJ1cHRlZCwg
YSBzdGFjayBidWZmZXIgb3ZlcmZsb3cgb2NjdXJzIHdoaWNoIGNhbiBiZSBmdXJ0aGVyIGxldmVy
YWdlZA0KdG8gZXhlY3V0ZSBhcmJpdHJhcnkgY29kZSB1bmRlciB0aGUgY29udGV4dCBvZiB0aGUg
Y3VycmVudCB1c2VyLg0KDQotLSBWZW5kb3IgUmVzcG9uc2U6DQpBcHBsZSBoYXMgaXNzdWVkIGFu
IHVwZGF0ZSB0byBjb3JyZWN0IHRoaXMgdnVsbmVyYWJpbGl0eS4gTW9yZQ0KZGV0YWlscyBjYW4g
YmUgZm91bmQgYXQ6DQoNCmh0dHA6Ly9zdXBwb3J0LmFwcGxlLmNvbS9rYi9IVDMwMjcNCg0KLS0g
RGlzY2xvc3VyZSBUaW1lbGluZToNCjIwMDgtMDYtMjUgLSBWdWxuZXJhYmlsaXR5IHJlcG9ydGVk
IHRvIHZlbmRvcg0KMjAwOC0wOS0wOSAtIENvb3JkaW5hdGVkIHB1YmxpYyByZWxlYXNlIG9mIGFk
dmlzb3J5DQoNCi0tIENyZWRpdDoNClRoaXMgdnVsbmVyYWJpbGl0eSB3YXMgZGlzY292ZXJlZCBi
eToNCiAgICAqIEFub255bW91cw0KDQotLSBBYm91dCB0aGUgWmVybyBEYXkgSW5pdGlhdGl2ZSAo
WkRJKToNCkVzdGFibGlzaGVkIGJ5IFRpcHBpbmdQb2ludCwgVGhlIFplcm8gRGF5IEluaXRpYXRp
dmUgKFpESSkgcmVwcmVzZW50cyANCmEgYmVzdC1vZi1icmVlZCBtb2RlbCBmb3IgcmV3YXJkaW5n
IHNlY3VyaXR5IHJlc2VhcmNoZXJzIGZvciByZXNwb25zaWJseQ0KZGlzY2xvc2luZyBkaXNjb3Zl
cmVkIHZ1bG5lcmFiaWxpdGllcy4NCg0KUmVzZWFyY2hlcnMgaW50ZXJlc3RlZCBpbiBnZXR0aW5n
IHBhaWQgZm9yIHRoZWlyIHNlY3VyaXR5IHJlc2VhcmNoDQp0aHJvdWdoIHRoZSBaREkgY2FuIGZp
bmQgbW9yZSBpbmZvcm1hdGlvbiBhbmQgc2lnbi11cCBhdDoNCg0KICAgIGh0dHA6Ly93d3cuemVy
b2RheWluaXRpYXRpdmUuY29tDQoNClRoZSBaREkgaXMgdW5pcXVlIGluIGhvdyB0aGUgYWNxdWly
ZWQgdnVsbmVyYWJpbGl0eSBpbmZvcm1hdGlvbiBpcw0KdXNlZC4gVGlwcGluZ1BvaW50IGRvZXMg
bm90IHJlLXNlbGwgdGhlIHZ1bG5lcmFiaWxpdHkgZGV0YWlscyBvciBhbnkNCmV4cGxvaXQgY29k
ZS4gSW5zdGVhZCwgdXBvbiBub3RpZnlpbmcgdGhlIGFmZmVjdGVkIHByb2R1Y3QgdmVuZG9yLA0K
VGlwcGluZ1BvaW50IHByb3ZpZGVzIGl0cyBjdXN0b21lcnMgd2l0aCB6ZXJvIGRheSBwcm90ZWN0
aW9uIHRocm91Z2gNCml0cyBpbnRydXNpb24gcHJldmVudGlvbiB0ZWNobm9sb2d5LiBFeHBsaWNp
dCBkZXRhaWxzIHJlZ2FyZGluZyB0aGUNCnNwZWNpZmljcyBvZiB0aGUgdnVsbmVyYWJpbGl0eSBh
cmUgbm90IGV4cG9zZWQgdG8gYW55IHBhcnRpZXMgdW50aWwNCmFuIG9mZmljaWFsIHZlbmRvciBw
YXRjaCBpcyBwdWJsaWNseSBhdmFpbGFibGUuIEZ1cnRoZXJtb3JlLCB3aXRoIHRoZQ0KYWx0cnVp
c3RpYyBhaW0gb2YgaGVscGluZyB0byBzZWN1cmUgYSBicm9hZGVyIHVzZXIgYmFzZSwgVGlwcGlu
Z1BvaW50DQpwcm92aWRlcyB0aGlzIHZ1bG5lcmFiaWxpdHkgaW5mb3JtYXRpb24gY29uZmlkZW50
aWFsbHkgdG8gc2VjdXJpdHkNCnZlbmRvcnMgKGluY2x1ZGluZyBjb21wZXRpdG9ycykgd2hvIGhh
dmUgYSB2dWxuZXJhYmlsaXR5IHByb3RlY3Rpb24gb3INCm1pdGlnYXRpb24gcHJvZHVjdC4NCg0K
T3VyIHZ1bG5lcmFiaWxpdHkgZGlzY2xvc3VyZSBwb2xpY3kgaXMgYXZhaWxhYmxlIG9ubGluZSBh
dDoNCg0KICAgIGh0dHA6Ly93d3cuemVyb2RheWluaXRpYXRpdmUuY29tL2Fkdmlzb3JpZXMvZGlz
Y2xvc3VyZV9wb2xpY3kvDQoNCkNPTkZJREVOVElBTElUWSBOT1RJQ0U6IFRoaXMgZS1tYWlsIG1l
c3NhZ2UsIGluY2x1ZGluZyBhbnkgYXR0YWNobWVudHMsDQppcyBiZWluZyBzZW50IGJ5IDNDb20g
Zm9yIHRoZSBzb2xlIHVzZSBvZiB0aGUgaW50ZW5kZWQgcmVjaXBpZW50KHMpIGFuZA0KbWF5IGNv
bnRhaW4gY29uZmlkZW50aWFsLCBwcm9wcmlldGFyeSBhbmQvb3IgcHJpdmlsZWdlZCBpbmZvcm1h
dGlvbi4NCkFueSB1bmF1dGhvcml6ZWQgcmV2aWV3LCB1c2UsIGRpc2Nsb3N1cmUgYW5kL29yIGRp
c3RyaWJ1dGlvbiBieSBhbnkgDQpyZWNpcGllbnQgaXMgcHJvaGliaXRlZC4gIElmIHlvdSBhcmUg
bm90IHRoZSBpbnRlbmRlZCByZWNpcGllbnQsIHBsZWFzZQ0KZGVsZXRlIGFuZC9vciBkZXN0cm95
IGFsbCBjb3BpZXMgb2YgdGhpcyBtZXNzYWdlIHJlZ2FyZGxlc3Mgb2YgZm9ybSBhbmQNCmFueSBp
bmNsdWRlZCBhdHRhY2htZW50cyBhbmQgbm90aWZ5IDNDb20gaW1tZWRpYXRlbHkgYnkgY29udGFj
dGluZyB0aGUNCnNlbmRlciB2aWEgcmVwbHkgZS1tYWlsIG9yIGZvcndhcmRpbmcgdG8gM0NvbSBh
dCBwb3N0bWFzdGVyQDNjb20uY29tLiANCg=