Apple fixes multiple QuickTime flaws |
 |
By Bill Brenner, Senior News Writer
06 Mar 2007 | SearchSecurity.com |
|
|
Apple Monday urged users of its QuickTime media player to upgrade to the latest version to correct multiple security flaws attackers could exploit to run insidious code on targeted machines by luring the user to a malicious Web site.
The French Security Incident Response Team (FrSIRT) rated the flaws critical in an 0825 advisory. It described the flaws as:
|
| Apple Quicktime: |
Jan. 2: Apple QuickTime flaw could enable botnets. Attackers could exploit a new Apple QuickTime flaw to grow their botnets by tricking users into visiting malicious Web sites, and then hijacking their machines.
Jan. 24: Apple fixes critical QuickTime flaw. The QuickTime flaw was disclosed earlier this month at the start of The Month of Apple Bugs Project.
File format vulnerabilities: Protecting your applications. From WMF to the latest Excel file exploits, it's clear that attacks targeting file format vulnerabilities are on the rise. In this tip, network security expert Mike Chapple examines why files have become a tempting vector, and explores what can be done. |
|
|
|
|
An integer overflow error that surfaces when the media player handles malformed 3GP video files.
A heap overflow error that surfaces when the media player handles a specially crafted MIDI file.
A buffer overflow error that occurs when the media player processes malformed QuickTime movies.
An ineteger overflow error that occurs when the media player handled malformed UDTA atoms in movie files.
A heap overflow error that occurs when the media player processes malformed PICT files.
Stack, integer and heap overflow errors that occur when the media player handles a malformed or specially crafted QTIF file.
The flaws affect Apple QuickTime 7.1.4 and prior. The solution is to upgrade to QuickTime 7.1.5.
Apple had previously updated QuickTime in January to fix a flaw that left users' machines open to bot infections.
That flaw was disclosed at the start of the year by the vulnerability researcher known as LMH. The researcher disclosed a variety of Apple flaws as part of his "Month of Apple Bugs" project.
|
|
|
|
