rapid7/metasploit-framework — pull request #521 by wchen-r7 (2012-06-24 07:09:39+00:00)
Title: Add Apple iTunes 10 Extended M3U Stack Buffer Overflow

New exploit against Apple iTunes. Note that this appears to be different than liquidworm's CVE-2012-0677, because this one is a stack-based buffer overflow, while CVE-2012-0677 is heap-based, and a different crash/backtrace. However, according to Rh0, this bug is patched anyway in the same update... possibly a silent patch. As of now, there seems to be no CVE or OSVDB addressing this particular bug.

This module exploits an extended .m3u file containing an "#EXTINF:" tag description, which iTunes will copy the content after "#EXTINF:" without appropriate checking from a heap buffer to a stack buffer, writing beyond the stack buffer's boundary, which allows code execution under the context of the user.