New Zero-Day QuickTime Vulnerability Emerges
Apple updated QuickTime to version 7.3 recently to address a much-exploited bug, but a new QuickTime vulnerability has emerged, prompting security agencies to issue warnings to those running QuickTime on either Windows XP or Windows Vista. There is no word yet on whether Mac OS X is vulnerable to the new QuickTime bug.
Apple’s QuickTime is vulnerable to malware disguised as streaming video, and attack code has been published on the milw0rm.com Web site, security researchers have warned. So far, while the vulnerability affects Windows XP and Windows Vista, the jury is still out on whether Apple’s own OS X is affected.
Apple programmers apparently made two mistakes. First, according to the U.S. Computer Emergency Readiness Team, QuickTime versions 7.2 and 7.3, and perhaps earlier versions, contain a buffer-overflow bug. “Apple QuickTime contains a stack buffer overflow vulnerability in the way QuickTime handles the RTSP Content-Type header,” US-CERT said. “This vulnerability may be exploited by convincing a user to connect to a specially crafted RTSP stream.”
RTSP is the Real-Time Streaming Protocol, which QuickTime supports. When users click on a link for a malicious RTSP stream, an attacker might be able to execute arbitrary code on the compromised system, US-CERT said.
Apple’s popular iTunes software uses QuickTime, so the risk could be quite widespread. While attack code has been published, no actual in-the-wild attacks have been reported.
Read the full story at newsfactor.com. Click Here
