-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

The canonical URI of this advisory is <http://remahl.se/david/vuln/=20
018/>.

This advisory concerns an as-yet unpatched problem in QuickTime 7 on =20
Mac OS X 10.4. The reason for disclosure before a vendor patch is =20
that another person realized the potential problem independently and =20
posted a message about it to the public mailing list quartzcomposer-=20
dev (hosted by Apple).

The suggested workaround is to disable the QuickTime browser plugin =20
until a fix is available from the vendor.

/ Regards, David Remahl

DR018: Quartz Composer / QuickTime 7 information leakage
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D

Date of discovery: 2005-04-26
Date of publication: 2005-05-11
Discovered by: David Remahl <david@remahl.se>
Advisory URL: http://remahl.se/david/vuln/018/
CVEs: n/a [as of this writing, the author is aware of =20=

no CVEs assigned to this vulnerability]
Classification: information exposure; design error
License: Public Domain

AFFECTED PRODUCTS
Verified vulnerable:
* Apple Mac OS X 10.4 (QuickTime 7)
Verified safe:
* Apple Mac OS X 10.3.9 (QuickTime 6.5, 7)
* QuickTime for Windows

INTRODUCTION

Quartz Composer files are created with the Quartz Composer =20
application included with the developer tools. The compositions (QTZ =20
files) it creates can be used as screen savers, viewed as they are in =20=

the application or embedded as QT atoms in a .mov container. As such, =20=

they can be viewed in a wide-ranging array of environments, including =20=

a web browser, Keynote 2 and the Finder.

Compositions have access to a number of powerful tools (patches), =20
each providing or acting-upon information, ultimately resulting in a =20
graphic composition. The design assumption seems to be that these =20
details should always be contained within the presentation. However, =20
by combining patches that provide advanced system information with =20
patches that load information from the Internet, a malicious .mov =20
file (viewed for example by the QuickTime web plugin) can leak this =20
information to an external host.

This issue has not been addressed by Apple yet, and because details =20
of the potential exploit appeard in a public forum shortly after I =20
had notified the vendor, a fix may still be some time away. A =20
temporary work-around is disabling the QuickTime plugin and treating =20
Quartz Composer files with suspicion.

IMPACT

The information that can be leaked by this method includes (but may =20
not be limited to):
=95 local user name (long and short)
=95 computer name
=95 local IP
=95 OS / kernel version
=95 CPU / RAM / GPU configuration
=95 names (human-readable) of Bonjour services on the local =20
network
=95 local or system time
=95 volume of audio input
=95 lists of images (including pdfs) matching arbitrary =20
spotlight queries
=95 lists of images (including pdfs) in specific directories =20=

(relative to / or ~)
=95 the existence of image and movie files can indicate the =20
existance of certain software packages

This information can be used for profiling of potential victims, for =20
further use in attacks against the user's system or phising related =20
social engineering.

DEMONSTRATION

A proof-of-concept in the form of a Quartz Composer composition =20
embedded in a .mov file is avaiilable at the following link. Please =20
see that document for more information.

http://remahl.se/david/vuln/018/demo.html

DETAILS

The basic attack works as follows:
1. A patch providing the information (for example the Host =20
Info patch) is created (A)
2. The output of (A) is connected to a JavaScript patch =20
which uses encodeURIComponent() to URI encode the string (B).
3. The output of (B) is connected to a String Printer which =20=

results in a URI, for example (C)
4. The output of (C) is connected to the URL input =20
connection of either the Image Downloader patch or the RSS Feed =20
patch. (D)
5. The output of (D) must be used somehow, otherwise this =20
part of the patch graph will not be used. Rendering the output (via a =20=

String to Image) to a 0-sized billboard is fine.
6. When the (D) patch is activated, it will access the URI =20
(output of (C)), thus leaking the restricted information to an HTTP =20
host of the attacker's choice.

VENDOR CONTACT

Apple Computer's security team was contacted with information about =20
the issue on 2005-05-06. Following a discussion of this problem on =20
the public quartzcomposer-dev mailinglist (initiated by a third-=20
party), the full details of the problems were released on May 11.

RESPONSE

Apple Computer
=95 2005-05-10, 04:50 UTC: Confirmed receipt of problem report =20=

(did not confirm issue).
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (Darwin)

iD8DBQFCgpysFlFiDoclYIURAucPAJ9CYHddNaBbv5DMf77FEQ k4UIbOdwCdFERf
/UINoKuuHPIrsMAKQVY4xbQ=3D
=3DLKr3
-----END PGP SIGNATURE-----