Apple QuickTime flaw could enable botnets

Article

Apple QuickTime flaw could enable botnets

Bill Brenner, Senior News Writer
The vulnerability researcher known as LMH kicked off what he calls a "Month of Apple Bugs" Monday by detailing a new flaw in Apple Computer Inc.'s widely used QuickTime media player. Attackers could exploit the issue to draft new machines into their botnets.

In a posting on his Apple Fun blog,

    Requires Free Membership to View

    Login

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

LMH described the flaw as a stack overflow error that surfaces when the program handles a malformed "rtsp" URL. To exploit this, attackers could set up a malicious Web site and lure users there. Or, they could trick users into opening a malicious .qtl file.

For more information

Check out our resources on Mac OS security

Nearly one year ago, Apple fixed multiple flaws in QuickTime
The flaw affects Apple QuickTime version 7.1.3 as well as earlier versions. As of Monday morning, Apple had not yet acknowledged the flaw, and the Cupertino, Calif.-based vendor did not immediately respond to a request for comment.

The French Security Incident Response Team (FrSIRT), which deemed the issue critical, recommended in an advisory that users disable Real Time Streaming Protocol support to mitigate the threat.

Calling the security hole highly critical, Danish vulnerability clearinghouse Secunia recommended in its advisory that users refrain from opening untrusted .qtl files.

This is LMH's second month-long project to expose numerous flaws affecting major computer vendors. In November, he conducted what was called the Month of Kernel Bugs, which was inspired by the Month of Browser Bugs spearheaded by Metasploit Framework creator H.D. Moore last July.