Apple releases QuickTime security fix |
 |
By Bill Brenner, Senior News Writer
06 Nov 2007 | SearchSecurity.com |
|
|
Apple Inc. released QuickTime 7.3 Monday to fix at least seven security flaws in the popular media player, days after security vendor Bit9 Inc. named QuickTime 7.2 the second-most-vulnerable application of 2007.
Cupertino, Calif.-based Apple said in its 306896 security advisory that the QuickTime updates apply to users running the application on Mac OS X and Microsoft Windows, including XP and Vista. The advisory mentions the following flaws and fixes:
A memory corruption issue exists in QuickTime's handling of image description atoms. By enticing a user to open a maliciously crafted movie file, an attacker may cause an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of QuickTime image descriptions.
A heap buffer overflow exists in QuickTime Player's handling of Sample Table Sample Descriptor (STSD) atoms. By enticing a user to open a maliciously crafted movie file, an attacker may cause an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of STSD atoms.
Multiple vulnerabilities exist in QuickTime for Java, which may allow untrusted Java applets to obtain elevated privileges. By enticing a user to visit a Web page containing a maliciously crafted Java applet, an attacker may cause the disclosure of sensitive information and arbitrary code execution with elevated privileges. This update addresses the issues by making QuickTime for Java no longer accessible to untrusted Java applets.
A stack buffer overflow exists in PICT image processing. By enticing a user to open a maliciously crafted image, an attacker may cause an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of PICT files.
A heap buffer overflow exists in PICT image processing. By enticing a user to open a maliciously crafted image, an attacker may cause an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of PICT files.
A heap buffer overflow exists in QuickTime's handling of panorama sample atoms in QTVR (QuickTime Virtual Reality) movie files. By enticing a user to view a maliciously crafted QTVR file, an attacker may cause an unexpected application termination or arbitrary code execution. This update addresses the issue by performing bounds checking on panorama sample atoms.
A heap buffer overflow exists in the parsing of the color table atom when opening a movie file. By enticing a user to open a maliciously crafted movie file, an attacker may cause an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of color table atoms.
These fixes come after QuickTime 7.2 last week was rated the second-most-vulnerable application on Bit9's list. Yahoo! Messenger 8.1.0.239 and earlier was named the most-flawed application. QuickTime was followed on the list by Mozilla Firefox 2.0.0.6, Microsoft Windows Live (MSN) Messenger 7.0, 8.0; EMC VMware Player (and other products) 2.0, 1.0.4; Apple iTunes 7.3.2; Intuit QuickBooks Online Edition 9 and earlier; Sun Java Runtime 1.6.0_X; Yahoo! Widgets 4.0.5 and previous; and Ask.com Toolbar 4.0.2.53 and previous.
|
|
|
|
