Computer Emergency Response Team - Industrie Services et Tertiaire The CERT for France Industry, Services and Tertiary sector
Members area version française [version française]
HOME PRESENTATION RESOURCES CONTACTS FAQ SEARCH
New critical RTSP vulnerability in Apple QuickTime
Public Advisories/Alerts
Cert-IST publications
Useful links
News - Events
Printable version
Accueil | Resources | Public Advisories/Alerts | Potential dangers

Reference: CERT-IST/DG-2008.002
Version: 1.1
Version date: 07 February 2008

Vulnerability Classification
Risk:
medium
Impact: Get access
Disrupt service
Confidence: Vendor-acknowledged
Attack expertise: Expert
Attack requirements: Remote (no account) over a standard service

System Information
Affected Platform(s):
  • Microsoft Windows systems
Affected Software(s):
  • Apple QuickTime versions prior to the version 7.3.1.70
Remarks:
  • It seems that the QuickTime vulnerability could be exploited only on Windows systems. Mac OS-X systems would therefore not be vulnerable.
  • QuickTime is also included in Apple "iTunes".
Impacted products

Description
Publication context:
 Version 1.1 : On February 04, 2008, Apple released the version 7.4.1 of QuickTime that fixes this vulnerability.
 The publication of that official fix closes, at Cert-IST side, the alert flag raised about that vulnerability. Please, now refer to the CERT-IST/AV-2008.047 advisory for an updated description of the vulnerability. 
In the present "Potential Danger" notice only the "Solution" section has been updated. Other sections are left unchanged to better reflect the situation that lead to the alert.

The Cert-IST releases this "Potential Danger" following the release of a new "0-day" that exploits a stack overflow in the brand new version of QuickTime (version 7.3.1). As a reminder, this version fixed the RTSP vulnerability described in the CERT-IST/DG-2007.009 potential danger and in the CERT-IST/AV-2007.536 advisory.
Problem description:
A "0-day" has just been released allowing to exploit a new flaw (without patch/solution) in the brand new version of QuickTime.

This program only enables to crash QuickTime. However existing exploits (November 2007) for a similar vulnerability in QuickTime (for which we released the CERT-IST/DG-2007.009 potential danger on November 30, 2007) could quickly be modified in order to exploit this new vulnerability.

As a reminder, those exploits enable a malicious person to remotely perform harmful actions on the system of a victim who clicks on a malicious RTSP link. Malicious actions are performed with the privileges of the user of the system hosting a vulnerable QuickTime version.

 The Cert-IST will release an alert as soon as we are informed that massive attacks occur. 
Technical context:
RTSP ("Real Time Streaming Protocol") is a protocol for use in streaming media systems over IP networks.
Technical information:
The vulnerability is a stack overflow that occurs when QuickTime displays a long message on the screen giving information on the connection status.

The most probable scenario for this attack is the following one :
  • The targetted victim clicks on a malicious "rtsp://" link redirecting towards a machine controlled by the attacker.
  • No RTSP server (port 554) is listening on this machine and QuickTime automatically decides to contact the HTTP port (port 80) on the same machine.
  • The message sent by the HTTP server causes the stack overflow.
Note: The malicious code that infects the victim's system runs with the privileges of this victim. In the case of a user with administrative privileges, the malicious code allows to take complete control of the infected system.

Solution

01 - Update QuickTime with the 7.4.1 version
02 - Workarounds regarding the QuickTime vulnerability

 Workarounds on user workstations 
    Several measures could be applied:
  • [1] Uninstall QuickTime.

  • [2] Configure QuickTime not to process the RTSP stream file:
    • On QuickTime, select "Edit" - "Preferences" - "QuickTime Preferences" - "MIME Types" - "Streaming- Streaming Movies" and unckeck "RTSP stream descriptor"

  • [3] Disable QuickTime web browser plugins:
    • On Internet Explorer, disable the QuickTime ActiveX controls:
      • The ActiveX controls ID (CLSID) on the system are:
        {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}
        {4063BE15-3B08-470D-A0D5-B37161CFFD69}
    • On Firefox, disable the QuickTime plugin (see the procedure in the URL below)

  • [4] Disable the file association for QuickTime files:
    • Delete the following registry keys: HKEY_CLASSES_ROOTQuickTime.*

Standard vulnerability IDs

Additional Resources

History
Version Comment Date
1.0 Potential danger creation 11 January 2008
1.1 Release of QuickTime 7.4.1 that fixes this vulnerability 07 February 2008

Copyright © 1999-2008 Cert-IST | Legal Notice | Sitemap