TUCoPS :: Macintosh :: bx2683.htm

TUCoPS :: Macintosh :: bx2683.htm
Apple QuickTime MP4A Atom Parsing Heap Corruption Vulnerability
ZDI-08-016: Apple QuickTime MP4A Atom Parsing Heap Corruption Vulnerability ZDI-08-016: Apple QuickTime MP4A Atom Parsing Heap Corruption Vulnerability

WkRJLTA4LTAxNjogQXBwbGUgUXVpY2tUaW1lIE1QNEEgQXRvbSBQYXJzaW5nIEhlYXAgQ29ycnVw
dGlvbiANClZ1bG5lcmFiaWxpdHkNCmh0dHA6Ly93d3cuemVyb2RheWluaXRpYXRpdmUuY29tL2Fk
dmlzb3JpZXMvWkRJLTA4LTAxNg0KQXByaWwgMywgMjAwOA0KDQotLSBDVkUgSUQ6DQpDVkUtMjAw
OC0xMDE4DQoNCi0tIEFmZmVjdGVkIFZlbmRvcnM6DQpBcHBsZQ0KDQotLSBBZmZlY3RlZCBQcm9k
dWN0czoNCkFwcGxlIFF1aWNrdGltZSA3LjQuMQ0KDQotLSBUaXBwaW5nUG9pbnQoVE0pIElQUyBD
dXN0b21lciBQcm90ZWN0aW9uOg0KVGlwcGluZ1BvaW50IElQUyBjdXN0b21lcnMgaGF2ZSBiZWVu
IHByb3RlY3RlZCBhZ2FpbnN0IHRoaXMNCnZ1bG5lcmFiaWxpdHkgYnkgRGlnaXRhbCBWYWNjaW5l
IHByb3RlY3Rpb24gZmlsdGVyIElEIDMzNzcuIA0KRm9yIGZ1cnRoZXIgcHJvZHVjdCBpbmZvcm1h
dGlvbiBvbiB0aGUgVGlwcGluZ1BvaW50IElQUywgdmlzaXQ6DQoNCiAgICBodHRwOi8vd3d3LnRp
cHBpbmdwb2ludC5jb20NCg0KLS0gVnVsbmVyYWJpbGl0eSBEZXRhaWxzOg0KVGhpcyB2dWxuZXJh
YmlsaXR5IGFsbG93cyByZW1vdGUgYXR0YWNrZXJzIHRvIGV4ZWN1dGUgYXJiaXRyYXJ5IGNvZGUg
b24NCnZ1bG5lcmFibGUgaW5zdGFsbGF0aW9ucyBvZiBBcHBsZSBRdWlja1RpbWUuIFVzZXIgaW50
ZXJhY3Rpb24gaXMNCnJlcXVpcmVkIHRvIGV4cGxvaXQgdGhpcyB2dWxuZXJhYmlsaXR5IGluIHRo
YXQgdGhlIHRhcmdldCBtdXN0IHZpc2l0IGENCm1hbGljaW91cyBwYWdlLg0KDQpUaGUgc3BlY2lm
aWMgZmxhdyBleGlzdHMgaW4gdGhlIHBhcnNpbmcgb2YgdGhlIFF1aWNrVGltZSBDaGFubmVsDQpD
b21wb3NpdG9yIGF0b20uIFdoZW4gdGhlIG1vdmllIGZpbGUgY29udGFpbnMgYSBtYWxmb3JtZWQg
J2NoYW4nIGF0b20sIGENCmhlYXAgY29ycnVwdGlvbiBvY2N1cnMgcmVzdWx0aW5nIGluIHRoZSBl
eGVjdXRpb24gb2YgYXJiaXRyYXJ5IGNvZGUuDQoNCi0tIFZlbmRvciBSZXNwb25zZToNCkFwcGxl
IGhhcyBpc3N1ZWQgYW4gdXBkYXRlIHRvIGNvcnJlY3QgdGhpcyB2dWxuZXJhYmlsaXR5LiBNb3Jl
DQpkZXRhaWxzIGNhbiBiZSBmb3VuZCBhdDoNCg0KaHR0cDovL3N1cHBvcnQuYXBwbGUuY29tL2ti
L0hUMTI0MQ0KDQotLSBEaXNjbG9zdXJlIFRpbWVsaW5lOg0KMjAwOC0wMi0wNyAtIFZ1bG5lcmFi
aWxpdHkgcmVwb3J0ZWQgdG8gdmVuZG9yDQoyMDA4LTA0LTAzIC0gQ29vcmRpbmF0ZWQgcHVibGlj
IHJlbGVhc2Ugb2YgYWR2aXNvcnkNCg0KLS0gQ3JlZGl0Og0KVGhpcyB2dWxuZXJhYmlsaXR5IHdh
cyBkaXNjb3ZlcmVkIGJ5Og0KICAgICogQW5vbnltb3VzDQoNCi0tIEFib3V0IHRoZSBaZXJvIERh
eSBJbml0aWF0aXZlIChaREkpOg0KRXN0YWJsaXNoZWQgYnkgVGlwcGluZ1BvaW50LCBUaGUgWmVy
byBEYXkgSW5pdGlhdGl2ZSAoWkRJKSByZXByZXNlbnRzIA0KYSBiZXN0LW9mLWJyZWVkIG1vZGVs
IGZvciByZXdhcmRpbmcgc2VjdXJpdHkgcmVzZWFyY2hlcnMgZm9yIHJlc3BvbnNpYmx5DQpkaXNj
bG9zaW5nIGRpc2NvdmVyZWQgdnVsbmVyYWJpbGl0aWVzLg0KDQpSZXNlYXJjaGVycyBpbnRlcmVz
dGVkIGluIGdldHRpbmcgcGFpZCBmb3IgdGhlaXIgc2VjdXJpdHkgcmVzZWFyY2gNCnRocm91Z2gg
dGhlIFpESSBjYW4gZmluZCBtb3JlIGluZm9ybWF0aW9uIGFuZCBzaWduLXVwIGF0Og0KDQogICAg
aHR0cDovL3d3dy56ZXJvZGF5aW5pdGlhdGl2ZS5jb20NCg0KVGhlIFpESSBpcyB1bmlxdWUgaW4g
aG93IHRoZSBhY3F1aXJlZCB2dWxuZXJhYmlsaXR5IGluZm9ybWF0aW9uIGlzDQp1c2VkLiBUaXBw
aW5nUG9pbnQgZG9lcyBub3QgcmUtc2VsbCB0aGUgdnVsbmVyYWJpbGl0eSBkZXRhaWxzIG9yIGFu
eQ0KZXhwbG9pdCBjb2RlLiBJbnN0ZWFkLCB1cG9uIG5vdGlmeWluZyB0aGUgYWZmZWN0ZWQgcHJv
ZHVjdCB2ZW5kb3IsDQpUaXBwaW5nUG9pbnQgcHJvdmlkZXMgaXRzIGN1c3RvbWVycyB3aXRoIHpl
cm8gZGF5IHByb3RlY3Rpb24gdGhyb3VnaA0KaXRzIGludHJ1c2lvbiBwcmV2ZW50aW9uIHRlY2hu
b2xvZ3kuIEV4cGxpY2l0IGRldGFpbHMgcmVnYXJkaW5nIHRoZQ0Kc3BlY2lmaWNzIG9mIHRoZSB2
dWxuZXJhYmlsaXR5IGFyZSBub3QgZXhwb3NlZCB0byBhbnkgcGFydGllcyB1bnRpbA0KYW4gb2Zm
aWNpYWwgdmVuZG9yIHBhdGNoIGlzIHB1YmxpY2x5IGF2YWlsYWJsZS4gRnVydGhlcm1vcmUsIHdp
dGggdGhlDQphbHRydWlzdGljIGFpbSBvZiBoZWxwaW5nIHRvIHNlY3VyZSBhIGJyb2FkZXIgdXNl
ciBiYXNlLCBUaXBwaW5nUG9pbnQNCnByb3ZpZGVzIHRoaXMgdnVsbmVyYWJpbGl0eSBpbmZvcm1h
dGlvbiBjb25maWRlbnRpYWxseSB0byBzZWN1cml0eQ0KdmVuZG9ycyAoaW5jbHVkaW5nIGNvbXBl
dGl0b3JzKSB3aG8gaGF2ZSBhIHZ1bG5lcmFiaWxpdHkgcHJvdGVjdGlvbiBvcg0KbWl0aWdhdGlv
biBwcm9kdWN0Lg0KDQpPdXIgdnVsbmVyYWJpbGl0eSBkaXNjbG9zdXJlIHBvbGljeSBpcyBhdmFp
bGFibGUgb25saW5lIGF0Og0KDQogICAgaHR0cDovL3d3dy56ZXJvZGF5aW5pdGlhdGl2ZS5jb20v
YWR2aXNvcmllcy9kaXNjbG9zdXJlX3BvbGljeS8NCg0KQ09ORklERU5USUFMSVRZIE5PVElDRTog
VGhpcyBlLW1haWwgbWVzc2FnZSwgaW5jbHVkaW5nIGFueSBhdHRhY2htZW50cywNCmlzIGJlaW5n
IHNlbnQgYnkgM0NvbSBmb3IgdGhlIHNvbGUgdXNlIG9mIHRoZSBpbnRlbmRlZCByZWNpcGllbnQo
cykgYW5kDQptYXkgY29udGFpbiBjb25maWRlbnRpYWwsIHByb3ByaWV0YXJ5IGFuZC9vciBwcml2
aWxlZ2VkIGluZm9ybWF0aW9uLg0KQW55IHVuYXV0aG9yaXplZCByZXZpZXcsIHVzZSwgZGlzY2xv
c3VyZSBhbmQvb3IgZGlzdHJpYnV0aW9uIGJ5IGFueSANCnJlY2lwaWVudCBpcyBwcm9oaWJpdGVk
LiAgSWYgeW91IGFyZSBub3QgdGhlIGludGVuZGVkIHJlY2lwaWVudCwgcGxlYXNlDQpkZWxldGUg
YW5kL29yIGRlc3Ryb3kgYWxsIGNvcGllcyBvZiB0aGlzIG1lc3NhZ2UgcmVnYXJkbGVzcyBvZiBm
b3JtIGFuZA0KYW55IGluY2x1ZGVkIGF0dGFjaG1lbnRzIGFuZCBub3RpZnkgM0NvbSBpbW1lZGlh
dGVseSBieSBjb250YWN0aW5nIHRoZQ0Kc2VuZGVyIHZpYSByZXBseSBlLW1haWwgb3IgZm9yd2Fy
ZGluZyB0byAzQ29tIGF0IHBvc3RtYXN0ZXJAM2NvbS5jb20uIA0K