Flip4Mac vulnerability -- disabling Flip4Mac; official word from Telestream

We've now received official word from Telestream, the developers of Flip4Mac, on this repeatable crash that might lead to arbitrary code execution:

"Flip4Mac has received reports of a QuickTime crash when playing a deliberately modified/damaged Windows Media file. There is no evidence that this has been or could be exploited to produce a security vulnerability.  We have reproduced the crash and will include a fix for this in our next release."

----

The Month of Apple Bugs Web site discusses a vulnerability affecting Flip4Mac -- software for playing Windows Media (WMV) files through QuickTime in Mac OS X.

According to the reported of the vulnerability, LMH, the potential for arbitrary code execution as a result of exploitation of this vulnerability is relatively high. He writes:

"It fails to properly handle WMV files with a crafted ASF_File_Properties_Object size field, leading to an exploitable memory corruption condition, which can be abused remotely for arbitrary code execution. [...] Given that we can overwrite saved eip (and thus subvert the execution flow) and provide any payload of our choice by appending it to the WMV file, exploitation for arbitrary code execution is clearly possible. Although, the conditions for PowerPC and x86 are slightly different, and thus the same file won't work for both architectures."

The only current preventative measure against this vulnerability is to uninstall Flip4Mac, either via the uninstall application shipped with the Flip4Mac download, or by deleting the following files:

• /Library/Internet Plug-Ins/Flip4Mac WMV Plugin.plugin
• /Library/Internet Plug-ins/Flip4Mac WMV Plugin.webplugin
• /Library/QuickTime/Flip4Mac WMV Import.component
• /Library/QuickTime/Flip4Mac WMV Export.component
• /Library/PreferencePanes/WmvPlayer.prefPanel
• /Library/Receipts/Flip4Mac WMV Import Installer.pkg
• /Library/Receipts/Flip4Mac WMV Export Installer.pkg

For further coverage, see our Flip4Mac product page.

Feedback? Late-breakers@macfixit.com.

Resources