CVE-2010-1818
Apple QuickTime - Remote Code Execution via Untrusted Pointer Unmarshalling
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2010-1818.
PoCs published by Metasploit, Ruben Santamarta, Ruben Santemarta, jduck, including Metasploit module exploits/windows/browser/apple_quicktime_marshaled_punk.
AI-analyzed exploit summary This Metasploit module exploits a memory trust issue in Apple QuickTime 7.6.7 via a crafted HTML page, leveraging heap spraying and ROP chains to bypass DEP/ASLR and achieve arbitrary code execution.
Description
The IPersistPropertyBag2::Read function in QTPlugin.ocx in Apple QuickTime 6.x, 7.x before 7.6.8, and other versions allows remote attackers to execute arbitrary code via the _Marshaled_pUnk attribute, which triggers unmarshalling of an untrusted pointer.
Exploits (3)
This Metasploit module exploits a memory trust issue in Apple QuickTime 7.6.7 via a crafted HTML page, leveraging heap spraying and ROP chains to bypass DEP/ASLR and achieve arbitrary code execution.
This is a detailed technical writeup explaining the vulnerability in Apple QuickTime's QTPlugin.ocx, specifically how the '_Marshaled_pUnk' parameter can be exploited to control an IStream pointer, leading to arbitrary code execution. The analysis includes reverse engineering insights and exploitation techniques.
This Metasploit module exploits a memory trust issue in Apple QuickTime 7.6.7 via a crafted HTML page, leveraging heap spraying and ROP chains to bypass DEP/ASLR and achieve arbitrary code execution.