Listen to this Post
The vulnerability exists in quartz.dll, the DirectShow QuickTime Movie Parser Filter, part of DirectX 7.0 through 9.0c. When processing a malicious QuickTime media file (.mov, .qt), the parser fails to validate a NULL byte in a specific data structure. An attacker crafts a file where an expected non-zero length field contains a zero (NULL) byte. The parser interprets this NULL as a string terminator, causing it to miscalculate buffer boundaries. Subsequently, a memory copy operation overwrites a critical pointer (e.g., a function pointer or return address) with attacker-controlled data. This overwrite is a “NULL byte overwrite” – the zero byte itself is the trigger. The corrupted pointer is later dereferenced during filter cleanup or playback, leading to arbitrary code execution in the context of the user running the vulnerable application (e.g., Windows Media Player, Internet Explorer via embedded video). The attack requires user interaction: opening the crafted file or visiting a malicious webpage hosting it. Exploitation in the wild was observed in May 2009, primarily targeting Windows XP SP2/SP3. The vulnerability is reachable without QuickTime Player installed because DirectShow provides its own parser. Remote attackers can achieve complete system compromise with no privilege escalation needed.
dailycve form:
Platform: Windows
Version: 2000/XP/Server2003
Vulnerability: NULL byte overwrite
Severity: Critical
Date: May 2009
Prediction: June 9 2009
What Undercode Say:
Check if quartz.dll is vulnerable (version <= 6.5.2600.3590 on XP)
md5sum C:\WINDOWS\system32\quartz.dll
Trigger crash for analysis (fuzzing template)
echo -ne '\x00\x00\x00\x10' > nullbyte.mov
python -c "open('poc.mov','wb').write(b'\x00'1024 + b'A'256)"
Monitor process with Process Monitor for NULL deref
procmon /AcceptEula /BackingFile directshow.pml /Quiet
Exploit:
Craft a QuickTime file with a `stbl` atom containing a `stts` entry where `sample_count` is set to zero (NULL dword). The parser reads `sample_count = 0` but then uses a precomputed offset, copying data onto a heap pointer. Overwrite the vtable of a C++ object in quartz.dll. Redirect execution to shellcode embedded in the file (e.g., calc.exe payload). Public exploits use SEH overwrite or ROP to bypass DEP.
Protection from this CVE
Install Microsoft security update MS09-028 (June 2009). Disable the QuickTime parser by setting `Kill Bit` for CLSID `{E436EBB8-524F-11CE-9F53-0020AF0BA770}` in registry. Unregister quartz.dll: regsvr32 /u quartz.dll. Use EMET (Enhanced Mitigation Experience Toolkit) to enable ASLR/DEP for wmplayer.exe and iexplore.exe.
Impact
Remote code execution with user privileges. Full system compromise – install programs, view/change/delete data, create new accounts. Wormable via drive-by download or email attachments. Affects Windows Media Player, Internet Explorer, and any DirectShow-based media player. Exploited in targeted attacks during May 2009 prior to patch.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
