A US-based security researcher has published a single piece of code that can remotely compromise both PCs and Macs as long as they are running Apple's QuickTime media player.
The exploit is at least the fourth to target a newly discovered security flaw in the way QuickTime interacts with servers that stream audio and video. Up until now, the exploits have only targeted machines running Windows operating systems, but Lorenzo Hernandez, the researcher who prefers to go by the name Larry, says his exploit also targets Tiger and Leopard versions of OS X running on both Intel-made processors or older machines that use the PowerPC chip.
"Our intention was to provide a highly educational exploit," Larry told El Reg. "We are trying to expose and show exploitation techniques for OS X."
Apple, which has yet to patch the vulnerability in QuickTime's real time streaming protocol response header, has not responded to requests for comment.
The exploit, which is published here, first analyzes the bowels of a user's machine to determine the OS it is running. It then unleashes a payload that is tailored to the specific platform. In order for the exploit to work, an attacker would have to trick a user into clicking on a booby-trapped link, or playlist.
"Apple software is exceedingly informative when it comes to versioning information, and this is a security risk because it helps to automate exploitation," said Larry, CEO of Wyoming-based security services company called Subreption.
He provides a detailed write up (here) that concludes that the latest version of OS X lacks several common sense measures that would make it less vulnerable to miscreants.
For one thing, there's no heap randomization, which makes it easy to find a relatively static address located in dynamically allocated memory. For another, Leopard doesn't implement memory protection enforcement. Finally, Leopard for PowerPC doesn't implement a non-executable stack, making them susceptible to stack-based buffer overflows.
Since Saturday, at least three other exploits targeting the same flaw have been published. A Tuesday posting by Errata Security's David Maynor said there were indications there are exploits in the wild, but that he had so far been unable to confirm those suspicions.
WabiSabiLabi, an online marketplace for security exploit code, said recently that QuickTime proof-of-concept code it has listed for more than a week exploits a different vulnerability in the popular media player.
------------------
This isn't the last QT exploit to target Mac...expect more in the near future.But I love the respond from Apple on a possible exploit for almost every OS X machine on the planet...."no comment". Are they serious?
This equates to hanging their users out to dry in my view.
Especially the users living in La-La Land that laugh about the idea of OS X malware.
If I asked a group of Windows users sitting at Starbucks the same question, I would guess that most would be semi-aware that they could be attacked or could have their information stolen...in a nutshell they are at least aware of the dangers.
Can we say the same for Mac users living in the Land of Enchantment protective bubble make of pixie dust? I'm not so sure.
In addition, why was this bug not discovered during the code review that should have been kicked off after the RTSP URL Handling Buffer Overflow Vulnerability early this year?
I know you can't find every bug in such a complex protocol within a couple of months...but even with my limited exploitation knowledge, this new bug doesn't sound that difficult.
Perhaps Apple should updated their Amazon Wishlist with a new book - Fuzzing: Brute Force Vulnerability Discovery.
No comments:
Post a Comment