Advisory: Apple Safari & Quicktime DoS

Subscribe to the RSS feed in case you are interested in updates

Release mode: No credit = no cooperation
Ref : [TZO-36-2009] - Apple Safari & Quicktime DoS
Vendor : http://www.apple.com
Status : Not patched (enough time was given)
Credit : none given ("can't find a place to credit")
Discovered : 18.11.2008 Zoller, 12.06.2009 Alexios Fakos (probably plenty of others)
Security notification reaction rating : good
Notification to patch window : n+1

Disclosure Policy : http://blog.zoller.lu/2008/09/notification-and-disclosure-policy.html

Affected products

• Apple Safari (all)
• Quicktime (all)

I. Background

Wikipedia quote: "Apple Inc. (NASDAQ: AAPL) is an American multinationalcorporation which designs and manufactures consumer electronics and software products. The company's best-known hardware products include Macintosh computers, the iPod and the iPhone."

II. Description
A null pointer is being dereference when CFRelease() is called on NULL.

III. Impact

The browser will crash, your data might be lost.

IV. Proof of concept (hold your breath)

Link

V. Disclosure timeline

DD/MM/YYYY

• 18/11/2008 : Send proof of concept file and a description that failed to give the correct impact
  
  
• 25/11/2008 : Apple acknowledges receipt and reproducibility :"After investigating this issue further, we've determined that the crash your test case triggers is caused by dereferencing a null pointer and not from a format string issue"
  
  
• 20/01/2009 : Ask for an update
  
  
• 23/01/2009 : Apple sends an encrypted and signed PGP mail, fine, however the mail is encrypted with their own key
  
  
• 23/01/2009 : Ask for the mail to be resend as I don't have Apple's private key
  
  
• 24/01/2009 : Apple states that "Regarding the QuickTime null dereference you reported, this bug is still being worked on by our engineers and is not addressed in QuickTime 7.6"
  
  
• 26/01/2009 : Ask apple for a fix time line as this is an ridiculously easy to fix vulnerability
  
  
• 27/01/2009 : Apple states "Regarding the QuickTime null deref issue, it is currently set to be part of the next QuickTime update. [..] Additionally, we do not intend to describe this crasher in our
  security advisory.

Note: No Security advisory = no credit, should have published here.

• 28/01/2009: Apple states "Given that we are handling this as a crasher and not as a security exposure, it stands to reason that you may want to disclose it without waiting for the update that addresses it and without further coordination with Apple.We do appreciate the fact that you reported it to us and are intending to address it in the next available update"

[..]
[Several discussion about CIA, why a DoS against the iPhone is worth a security
advisory, when it isn't against safari.. etc. I spare you the details]
[..]

• 29/01/2009: Ask why I should hold disclosure for a DoS in a particular portable apple product but disclose DoS in other apple products. Asked apple to make a choice, either DoS is a security issue and I won't disclose or it isn't and I disclose all of them, including the one in the very portable apple product
  

• 30/01/2009 : Apple answers that : "Your QuickTime and Safari issues constitute denial of service.We consider any denial of service issue to be security related, and they are important to fix. We plan to fix the ones you reported in the next available updates." [..] I was not able to locate a suitable place for crediting the QuickTime crasher"

Fast forward 5 months, and Apple releases a stream of code execution bug fixes for Quicktime.

• 01/06/2009 : Ask for an update and if the DoS condition has been fixed

• 02/06/2009 : Apple states that "According to our bug tracking system the null-dereference crasher issue is not yet addressed in QuickTime. We are investigating now to see if for some reason the latest version has picked up changes that address this issue and will send you feedback today about it."

In summary, no credit, no advisory, and 7 months of time to (not) fix a single line of code.

• 14/06/2009 : Release of this advisory