TUCoPS :: Macintosh :: bx3466.htm

TUCoPS :: Macintosh :: bx3466.htm
Apple QuickTime Indeo Video Buffer Overflow Vulnerability
ZDI-08-037: Apple QuickTime Indeo Video Buffer Overflow Vulnerability ZDI-08-037: Apple QuickTime Indeo Video Buffer Overflow Vulnerability

WkRJLTA4LTAzNzogQXBwbGUgUXVpY2tUaW1lIEluZGVvIFZpZGVvIEJ1ZmZlciBPdmVyZmxvdyBW
dWxuZXJhYmlsaXR5DQpodHRwOi8vd3d3Lnplcm9kYXlpbml0aWF0aXZlLmNvbS9hZHZpc29yaWVz
L1pESS0wOC0wMzcNCkp1bmUgMTAsIDIwMDgNCg0KLS0gQ1ZFIElEOg0KQ1ZFLTIwMDgtMTU4NA0K
DQotLSBBZmZlY3RlZCBWZW5kb3JzOg0KQXBwbGUNCg0KLS0gQWZmZWN0ZWQgUHJvZHVjdHM6DQpB
cHBsZSBRdWlja3RpbWUNCg0KLS0gVGlwcGluZ1BvaW50KFRNKSBJUFMgQ3VzdG9tZXIgUHJvdGVj
dGlvbjoNClRpcHBpbmdQb2ludCBJUFMgY3VzdG9tZXJzIGhhdmUgYmVlbiBwcm90ZWN0ZWQgYWdh
aW5zdCB0aGlzDQp2dWxuZXJhYmlsaXR5IGJ5IERpZ2l0YWwgVmFjY2luZSBwcm90ZWN0aW9uIGZp
bHRlciBJRCA1OTk3LiANCkZvciBmdXJ0aGVyIHByb2R1Y3QgaW5mb3JtYXRpb24gb24gdGhlIFRp
cHBpbmdQb2ludCBJUFMsIHZpc2l0Og0KDQogICAgaHR0cDovL3d3dy50aXBwaW5ncG9pbnQuY29t
DQoNCi0tIFZ1bG5lcmFiaWxpdHkgRGV0YWlsczoNClRoaXMgdnVsbmVyYWJpbGl0eSBhbGxvd3Mg
YXR0YWNrZXJzIHRvIGV4ZWN1dGUgYXJiaXRyYXJ5IGNvZGUgb24NCnZ1bG5lcmFibGUgaW5zdGFs
bGF0aW9ucyBvZiBBcHBsZSBRdWlja3RpbWUgUGxheWVyLiBVc2VyIGludGVyYWN0aW9uDQppcyBy
ZXF1aXJlZCB0byBleHBsb2l0IHRoaXMgdnVsbmVyYWJpbGl0eSBpbiB0aGF0IHRoZSB0YXJnZXQg
bXVzdCB2aXNpdA0KYSBtYWxpY2lvdXMgcGFnZSBvciBvcGVuIGEgbWFsaWNpb3VzIGZpbGUuDQoN
ClRoZSBzcGVjaWZpYyBmbGF3IGV4aXN0cyB3aXRoaW4gdGhlIHBhcnNpbmcgb2YgUXVpY2t0aW1l
IGZpbGVzIHRoYXQNCnV0aWxpemUgdGhlIEluZGVvIHZpZGVvIGNvZGVjLiBBIGxhY2sgb2YgcHJv
cGVyIGJvdW5kcyBjaGVja2luZyB3aXRoaW5nDQpJbmRlby5xdHggY2FuIHJlc3VsdCBpbiBhIHN0
YWNrIGJhc2VkIGJ1ZmZlciBvdmVyZmxvdyBsZWFkaW5nIHRvIGFyYml0cmFyeSANCmNvZGUNCmV4
ZWN1dGlvbiB1bmRlciB0aGUgY29udGV4dCBvZiB0aGUgY3VycmVudGx5IGxvZ2dlZCBpbiB1c2Vy
Lg0KDQotLSBWZW5kb3IgUmVzcG9uc2U6DQpBcHBsZSBoYXMgaXNzdWVkIGFuIHVwZGF0ZSB0byBj
b3JyZWN0IHRoaXMgdnVsbmVyYWJpbGl0eS4gTW9yZQ0KZGV0YWlscyBjYW4gYmUgZm91bmQgYXQ6
DQoNCmh0dHA6Ly9zdXBwb3J0LmFwcGxlLmNvbS9rYi9IVDEyMjINCg0KLS0gRGlzY2xvc3VyZSBU
aW1lbGluZToNCjIwMDgtMDItMDcgLSBWdWxuZXJhYmlsaXR5IHJlcG9ydGVkIHRvIHZlbmRvcg0K
MjAwOC0wNi0xMCAtIENvb3JkaW5hdGVkIHB1YmxpYyByZWxlYXNlIG9mIGFkdmlzb3J5DQoNCi0t
IENyZWRpdDoNClRoaXMgdnVsbmVyYWJpbGl0eSB3YXMgZGlzY292ZXJlZCBieToNCiAgICAqIEFu
b255bW91cw0KDQotLSBBYm91dCB0aGUgWmVybyBEYXkgSW5pdGlhdGl2ZSAoWkRJKToNCkVzdGFi
bGlzaGVkIGJ5IFRpcHBpbmdQb2ludCwgVGhlIFplcm8gRGF5IEluaXRpYXRpdmUgKFpESSkgcmVw
cmVzZW50cyANCmEgYmVzdC1vZi1icmVlZCBtb2RlbCBmb3IgcmV3YXJkaW5nIHNlY3VyaXR5IHJl
c2VhcmNoZXJzIGZvciByZXNwb25zaWJseQ0KZGlzY2xvc2luZyBkaXNjb3ZlcmVkIHZ1bG5lcmFi
aWxpdGllcy4NCg0KUmVzZWFyY2hlcnMgaW50ZXJlc3RlZCBpbiBnZXR0aW5nIHBhaWQgZm9yIHRo
ZWlyIHNlY3VyaXR5IHJlc2VhcmNoDQp0aHJvdWdoIHRoZSBaREkgY2FuIGZpbmQgbW9yZSBpbmZv
cm1hdGlvbiBhbmQgc2lnbi11cCBhdDoNCg0KICAgIGh0dHA6Ly93d3cuemVyb2RheWluaXRpYXRp
dmUuY29tDQoNClRoZSBaREkgaXMgdW5pcXVlIGluIGhvdyB0aGUgYWNxdWlyZWQgdnVsbmVyYWJp
bGl0eSBpbmZvcm1hdGlvbiBpcw0KdXNlZC4gVGlwcGluZ1BvaW50IGRvZXMgbm90IHJlLXNlbGwg
dGhlIHZ1bG5lcmFiaWxpdHkgZGV0YWlscyBvciBhbnkNCmV4cGxvaXQgY29kZS4gSW5zdGVhZCwg
dXBvbiBub3RpZnlpbmcgdGhlIGFmZmVjdGVkIHByb2R1Y3QgdmVuZG9yLA0KVGlwcGluZ1BvaW50
IHByb3ZpZGVzIGl0cyBjdXN0b21lcnMgd2l0aCB6ZXJvIGRheSBwcm90ZWN0aW9uIHRocm91Z2gN
Cml0cyBpbnRydXNpb24gcHJldmVudGlvbiB0ZWNobm9sb2d5LiBFeHBsaWNpdCBkZXRhaWxzIHJl
Z2FyZGluZyB0aGUNCnNwZWNpZmljcyBvZiB0aGUgdnVsbmVyYWJpbGl0eSBhcmUgbm90IGV4cG9z
ZWQgdG8gYW55IHBhcnRpZXMgdW50aWwNCmFuIG9mZmljaWFsIHZlbmRvciBwYXRjaCBpcyBwdWJs
aWNseSBhdmFpbGFibGUuIEZ1cnRoZXJtb3JlLCB3aXRoIHRoZQ0KYWx0cnVpc3RpYyBhaW0gb2Yg
aGVscGluZyB0byBzZWN1cmUgYSBicm9hZGVyIHVzZXIgYmFzZSwgVGlwcGluZ1BvaW50DQpwcm92
aWRlcyB0aGlzIHZ1bG5lcmFiaWxpdHkgaW5mb3JtYXRpb24gY29uZmlkZW50aWFsbHkgdG8gc2Vj
dXJpdHkNCnZlbmRvcnMgKGluY2x1ZGluZyBjb21wZXRpdG9ycykgd2hvIGhhdmUgYSB2dWxuZXJh
YmlsaXR5IHByb3RlY3Rpb24gb3INCm1pdGlnYXRpb24gcHJvZHVjdC4NCg0KT3VyIHZ1bG5lcmFi
aWxpdHkgZGlzY2xvc3VyZSBwb2xpY3kgaXMgYXZhaWxhYmxlIG9ubGluZSBhdDoNCg0KICAgIGh0
dHA6Ly93d3cuemVyb2RheWluaXRpYXRpdmUuY29tL2Fkdmlzb3JpZXMvZGlzY2xvc3VyZV9wb2xp
Y3kvDQoNCkNPTkZJREVOVElBTElUWSBOT1RJQ0U6IFRoaXMgZS1tYWlsIG1lc3NhZ2UsIGluY2x1
ZGluZyBhbnkgYXR0YWNobWVudHMsDQppcyBiZWluZyBzZW50IGJ5IDNDb20gZm9yIHRoZSBzb2xl
IHVzZSBvZiB0aGUgaW50ZW5kZWQgcmVjaXBpZW50KHMpIGFuZA0KbWF5IGNvbnRhaW4gY29uZmlk
ZW50aWFsLCBwcm9wcmlldGFyeSBhbmQvb3IgcHJpdmlsZWdlZCBpbmZvcm1hdGlvbi4NCkFueSB1
bmF1dGhvcml6ZWQgcmV2aWV3LCB1c2UsIGRpc2Nsb3N1cmUgYW5kL29yIGRpc3RyaWJ1dGlvbiBi
eSBhbnkgDQpyZWNpcGllbnQgaXMgcHJvaGliaXRlZC4gIElmIHlvdSBhcmUgbm90IHRoZSBpbnRl
bmRlZCByZWNpcGllbnQsIHBsZWFzZQ0KZGVsZXRlIGFuZC9vciBkZXN0cm95IGFsbCBjb3BpZXMg
b2YgdGhpcyBtZXNzYWdlIHJlZ2FyZGxlc3Mgb2YgZm9ybSBhbmQNCmFueSBpbmNsdWRlZCBhdHRh
Y2htZW50cyBhbmQgbm90aWZ5IDNDb20gaW1tZWRpYXRlbHkgYnkgY29udGFjdGluZyB0aGUNCnNl
bmRlciB2aWEgcmVwbHkgZS1tYWlsIG9yIGZvcndhcmRpbmcgdG8gM0NvbSBhdCBwb3N0bWFzdGVy
QDNjb20uY29tLiANCg=