Apple Motion Integer Overflow Vulnerability
===========================================
Vendor: Apple (http://www.apple.com)
Software: Motion 5.0.7
Testcase verified on: OS X 10.8
Credit: Jean Pascal Pereira <pereira@secbiz.de>
DESCRIPTION
===========
An integer overflow vulnerability has been identified in Apple Motion. The issue has been verified for Motion 5.0.7 (current release). Prior versions may also be affected.
An attacker has the possibility to provide a crafted .motn file containing a viewer element with a subview attribute. If the subview attribute is set to a very low or high integer value, the application crashes due an access violation.
Debug message:
Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x00000002dd6e0990
0x0000000100858eb7 in OZDocument::parseElement ()
The crash is triggered in the function OZDocument::parseElement() at the following instruction: