quicktime.util.QTByteObject Initialization Security Checks Bypass

/*## (c) SECURITY EXPLORATIONS    2012 poland                                #*/
/*##     http://www.security-explorations.com                                #*/

/* Apple QuickTime Java extensions                                            */
/* quicktime.util.QTByteObject initialization security checks bypass          */

In order to test the POC code for the reported Issue 22, manually add
Vuln22Setup.class and Vuln22Setup$1.class to the original QTJava.zip
file from your CLASSPATH environment variable. This file is usually
located in lib\ext directory of your JRE base dir:

Microsoft Windows [Wersja 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. Wszelkie prawa zastrzezone.

c:\>set
ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Internet\AppData\Roaming
CLASSPATH=.;C:\_SOFTWARE\jre6\lib\ext\QTJava.zip
COMMANDER_DRIVE=C:
...

Both Vuln22Setup and Vuln22Setup$1 classes mimic undisclosed and not
yet patched, Oracle's Issue 15.

Successfull exploit run should lead to the execution of notepad.exe and
c:\se.txt file creation. Additionally, Java console output similar to the
one denoted below should be observed:

Java Plug-in 1.6.0_33
Using JRE version 1.6.0_33-b03 Java HotSpot(TM) Client VM
User home directory = C:\Users\Internet

----------------------------------------------------
c:   clear console window
f:   finalize objects on finalization queue
g:   garbage collect
h:   display this help message
l:   dump classloader list
m:   print memory usage
o:   trigger logging
q:   hide console
r:   reload policy configuration
s:   dump system and deployment properties
t:   dump thread list
v:   dump thread stack
x:   clear classloader cache
0-5: set trace level to <n>
----------------------------------------------------

Security manager = sun.plugin2.applet.Applet2SecurityManager@15cda3f
QTSession.hasSecurityRestrictions() = true
Created: MyQTByteObject
using off 0x24d00000 for Windows 7 (x86)
found Marker instance at 0x251e0008
Security manager = null

===
PoC
===

http://www.exploit-db.com/sploits/19401.zip

========
Advisory
========

http://www.exploit-db.com/sploits/19401.pdf