Rapid7 Vulnerability & Exploit Database

Apple iTunes 10 Extended M3U Stack Buffer Overflow

Back to Search

Apple iTunes 10 Extended M3U Stack Buffer Overflow

Disclosed
06/21/2012
Created
05/30/2018

Description

This module exploits a stack buffer overflow in iTunes 10.4.0.80 to 10.6.1.7. When opening an extended .m3u file containing an "#EXTINF:" tag description, iTunes will copy the content after "#EXTINF:" without appropriate checking from a heap buffer to a stack buffer, writing beyond the stack buffer's boundary, which allows code execution under the context of the user. Please note before using this exploit, you must have precise knowledge of the victim machine's QuickTime version (if installed), and then select your target accordingly. In addition, even though this exploit can be used as remote, you should be aware the victim's browser behavior when opening an itms link. For example, IE/Firefox/Opera by default will ask the user for permission before launching the itms link by iTunes. Chrome will ask for permission, but also spits a warning. Safari would be an ideal target, because it will open the link without any user interaction.

Author(s)

  • Rh0 <rh0@z1p.biz>
  • sinn3r <sinn3r@metasploit.com>

Platform

Windows

Architectures

x86

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/windows/misc/itunes_extm3u_bof
msf exploit(itunes_extm3u_bof) > show targets
    ...targets...
msf exploit(itunes_extm3u_bof) > set TARGET < target-id >
msf exploit(itunes_extm3u_bof) > show options
    ...show and set options...
msf exploit(itunes_extm3u_bof) > exploit

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;