________________________________________________________________________

               Apple Safari & Quicktime Denial of Service
________________________________________________________________________

Shameless plug :
------------------------------------------------------------------------
You are invited to join the 2009 edition of HACK.LU, a small but 
concentrated luxemburgish security conference. 
More information : http://www.hack.lu - CFP is open, sponsorship is still 
possible and warmly welcomed.
------------------------------------------------------------------------

Release mode: Coordinated
Ref         : [TZO-36-2009] - Apple Safari & Quicktime DoS
Vendor : http://www.apple.com 
WWW : http://blog.zoller.lu/2009/05/advisory-apple-safari-quicktime-dos.html 
Status      : Not patched
Credit      : none given (Apple can't find a place to credit)
Discovered  : 18.11.2008 Zoller, 19.06.2009 Alexios Fakos (probably plenty
              of others)
Security notification reaction rating : good
Notification to patch window : n+1 

Disclosure Policy : http://blog.zoller.lu/2008/09/notification-and-disclosure-policy.html 

Affected products  
- Apple Safari (all)
- Quicktime (all)


I. Background
~~~~~~~~~~~~~
Wikipedia quote: "Apple Inc. (NASDAQ: AAPL) is an American multinational 
corporation which designs and manufactures consumer electronics and 
software products. The company's best-known hardware products include 
Macintosh computers, the iPod and the iPhone."

II. Description
~~~~~~~~~~~~~~~
A null pointer is being dereference when CFRelease() is called on NULL.

III. Impact
~~~~~~~~~~~
The browser will crash, your data might be lost.

IV. Proof of concept (hold your breath)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




V. Disclosure timeline
~~~~~~~~~~~~~~~~~~~~~~~~~
DD/MM/YYYY
18/11/2008 : Send proof of concept file and a description that failed to
             give the correct impact.
        
25/11/2009 : Apple acknowledges receipt and reproducability :  
             "After investigating this issue further, we've determined 
             that the crash your test case triggers is caused by
             dereferencing a null pointer and not from a format string issue"
                         
20/01/2009 : Ask for an update                   
                         
23/01/2009 : Apple sends an encrypted and signed PGP mail, fine, however the mail
             is encrypted with their own key

23/01/2009 : Ask for the mail to be resend as I don't have Apple's private key

24/01/2009 : Apple states that "Regarding the QuickTime null dereference you 
             reported, this bug is still being worked on by our engineers 
             and is not addressed in QuickTime 7.6"
                         
26/01/2009 : Ask apple for a fix timeline as this is an ridiculouly easy to fix
             vulnerability                       
                         
27/01/2009 : Apple statest "Regarding the QuickTime null deref issue, it is 
             currently set to be part of the next QuickTime update.  [..] 
             Additionally, we do not intend to describe this crasher in our
             security advisory.
                         
             Note: No Security advisory = no credit, should have published here.
                         
28/01/2009: Apple states "Given that we are handling this as a crasher and 
            not as a security exposure, it stands to reason that you may 
            want to disclose it without waiting for the update that
            addresses it and without further coordination with Apple.
            We do appreciate the fact that you reported it to us and are
            intending to address it in the next available update"

[..]                    
[Several discussion about CIA, why a DoS against the iPhone is worth a security
advisory, when it isn't against safari.. etc. I spare you the details]                  
[..]

29/01/2009 : Ask why I should hold disclosure for a DoS in a particular
             portable apple product but disclose DoS in other apple products.
             Asked apple to make a choice, either DoS is a security issue and
             I won't disclose or it isn't and I disclose all of them,
             including the one in the very portable apple product
                          
30/01/2009  : Apple answers that
             "Your QuickTime and Safari issues constitute denial of service.
             We consider any denial of service issue to be security related,
             and they are important to fix.  We plan to fix the ones you
             reported in the next available updates."

             "I believe we can put credit in an appropriate place for the
             WebKit/Safari change.  I was not able to locate a suitable place
             for crediting the QuickTime crasher"
                          
Fast forward 5 months, and apple releases a stream of code execution bug fixes
for Quicktime.

01/06/2009 : Ask for an update and if the DoS condition has been fixed
                          
02/06/2009 : Apple states that 
             "According to our bug tracking system the null-dereference crasher
             issue is not yet addressed in QuickTime.  We are investigating
             now to see if for some reason the latest version has picked up
             changes that address this issue and will send you feedback
             today about it."
        
In summary, no credit, no advisory, and 7 months of time to (not) fix a
single  line  of  code.

10/06/2009 : Release of this advisory