Old Apple QuickTime code puts IE users in harm's way

Exploit bypasses Windows' DEP, ASLR defenses, can be used in drive-by attacks

Apple's failure to clean up old code in QuickTime leaves people running Internet Explorer (IE) vulnerable to drive-by attacks, a Spanish security researcher said today.

Ruben Santamarta, a researcher at Madrid-based Wintercore who revealed a bug in IE8 last month, today outlined the QuickTime plug-in vulnerability.

Hackers only need to dupe users into visiting a malicious site hosting exploit code, said Santamarta, who added that his attack code works when someone browses with IE on a machine running Windows XP, Vista or Windows 7 that has QuickTime 7.x or the older QuickTime 6.x installed.

Santamarta's exploit works because Apple didn't tidy up QuickTime's code after developers dropped the "_Marshaled_pUnk" function.

"Although this functionality was removed in newer versions, the parameter is still present," Santamarta wrote in his advisory. "Why? I guess someone forgot to clean up the code."

His attack code also bypasses a pair of important security measures Microsoft has added to Windows: DEP (data execution prevention) and ASLR (address space layout randomization).

DEP and ASLR sidestepping isn't new: In late March, Dutch researcher Peter Vreugdenhil exploited a vulnerability in IE8 running on Windows 7 with attack code that evaded DEP and ASLR to win $10,000 at the fourth-annual Pwn2Own contest. And last month, Santamarta said that the IE8 bug he published could also be used to bypass the technologies.

"This issue can be used in a drive-by attack, as QuickTime is widely deployed, and for some reason people still [use] IE," said HD Moore, chief security officer at Rapid7 and the creator of the Metasploit penetration testing framework, in an e-mail. "Unlike other browser -based exploits, Windows 7 with ASLR/DEP will not make an appreciable difference due to the presence of an unprotected DLL within QuickTime itself."

In his advisory, Santamarta said he had sent details of his exploit to Metasploit. Moore confirmed that Metasploit developers are working on a module for the hacking toolkit, and are shooting for a Tuesday release of a reliable exploit.

Like Santamarta, Moore believes that the bug was an oversight, not an intentional back door left by an Apple programmer.

Attacks that leverage Santamarta's bug will probably pop up soon, Moore added.

"This exploit will likely make it into the wild; the complete exploit details were provided as part of the initial blog post and with the QuickTime install base being what it is, there is incentive to include this vulnerability into the various [exploit] kits," Moore said.

Until Apple issues a patch, users can stymie attacks by uninstalling or disabling the QuickTime plug-in. Symantec recommended that users set the killbit for the QuickTime ActiveX control or rename the plug-in.

Instructions for setting an ActiveX control's killbit can be found on Microsoft's support site .

Apple last patched QuickTime for Windows on Aug. 11 when it shipped version 7.6.7 to fix a different bug in the program's error logging.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed . His e-mail address is gkeizer@ix.netcom.com .

Read more about security in Computerworld's Security Topic Center.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags AppleMicrosoftsecurityWindowssoftwareMalware and Vulnerabilitiesoperating systems

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld (US)
Show Comments

Essentials

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?