Article

Apple fixes multiple QuickTime flaws

Bill Brenner
Apple Monday urged users of its QuickTime media player to upgrade to the latest version to correct multiple security flaws attackers could exploit to run insidious code on targeted machines by luring the user to a malicious Web site.

    Requires Free Membership to View

The French Security Incident Response Team (FrSIRT) rated the flaws critical in an 0825 advisory. It described the flaws as:

Apple Quicktime:
Jan. 2: Apple QuickTime flaw could enable botnets. Attackers could exploit a new Apple QuickTime flaw to grow their botnets by tricking users into visiting malicious Web sites, and then hijacking their machines.

Jan. 24: Apple fixes critical QuickTime flaw. The QuickTime flaw was disclosed earlier this month at the start of The Month of Apple Bugs Project.

File format vulnerabilities: Protecting your applications. From WMF to the latest Excel file exploits, it's clear that attacks targeting file format vulnerabilities are on the rise. In this tip, network security expert Mike Chapple examines why files have become a tempting vector, and explores what can be done.

  • An integer overflow error that surfaces when the media player handles malformed 3GP video files.
  • A heap overflow error that surfaces when the media player handles a specially crafted MIDI file.
  • A buffer overflow error that occurs when the media player processes malformed QuickTime movies.
  • An ineteger overflow error that occurs when the media player handled malformed UDTA atoms in movie files.
  • A heap overflow error that occurs when the media player processes malformed PICT files.
  • Stack, integer and heap overflow errors that occur when the media player handles a malformed or specially crafted QTIF file.
  • The flaws affect Apple QuickTime 7.1.4 and prior. The solution is to upgrade to QuickTime 7.1.5.

    Apple had previously updated QuickTime in January to fix a flaw that left users' machines open to bot infections.

    That flaw was disclosed at the start of the year by the vulnerability researcher known as LMH. The researcher disclosed a variety of Apple flaws as part of his "Month of Apple Bugs" project.


    There are Comments. Add yours.

     
    TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

    REGISTER or login:

    Forgot Password?
    By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
    Sort by: OldestNewest

    Forgot Password?

    No problem! Submit your e-mail address below. We'll send you an email containing your password.

    Your password has been sent to: