Update title & description to match what ZDI has.

ZDI publishes a new advisory that's closer to what we actually
see in a debugger. So we update the reference, as well as the
description + title to better match up theirs.
unstable
sinn3r 2012-06-29 11:10:28 -05:00
parent 19b6ebbfbf
commit 196e1b7f70
1 changed files with 4 additions and 7 deletions

View File

@ -15,16 +15,13 @@ class Metasploit3 < Msf::Exploit::Remote
def initialize(info = {})
super(update_info(info,
'Name' => 'Apple QuickTime TeXML Stack Buffer Overflow',
'Name' => 'Apple QuickTime TeXML Style Element Stack Buffer Overflow',
'Description' => %q{
This module exploits a vulnerability found in Apple QuickTime. When handling
a TeXML file, it is possible to trigger a stack-based buffer overflow, and then
gain arbitrary code execution under the context of the user. The flaw is
generally known as a bug while processing the 'transform' attribute, however,
that attack vector seems to only cause a TerminateProcess call due to a corrupt
stack cookie, and more data will only trigger a warning about the malformed XML
file. This module exploits the 'color' value instead, which accomplishes the same
thing.
gain arbitrary code execution under the context of the user. This is due to the
QuickTime3GPP.gtx component not handling certain Style subfields properly, storing
user-supplied data on the stack, which results the overflow.
},
'License' => MSF_LICENSE,
'Author' =>