Home > News > Security > Apple releases 'highly critical' QuickTime patch

Apple releases 'highly critical' QuickTime patch

Fix available for remote-code exploit released New Year's Day.

Apple has patched a 'highly critical' vulnerability in QuickTime for both Mac OS and Windows.

The vulnerability, which was disclosed on the first day of the Month of Apple Bugs (MoAB) project, could allow an attacker to take control of a system and execute malicious code.

Security firm Secunia rated the vulnerability as 'highly critical', the company's second-highest alert level.

The attack is carried out when a user accesses a specially crafted QuickTime Link file. The exploit file then uses a vulnerability in the handling of RSTP (streaming media) URLs to cause an error and gain access to the system.

The official fix for the vulnerability can be downloaded from Apple's website or through the software update component in Mac OS X.

Exploit code for the vulnerability was first posted on 1 January by a researcher known as 'LMH'. The vulnerability was the first in the MoAB project, which aims to disclose a new Mac OS X vulnerability every day of the month.

An unofficial patch for the vulnerability was released on the same day by developer Landon Fuller, who is running a counter-project to patch each of the MoAB vulnerabilities.

Secunia warned users of unpatched systems to avoid opening untrusted QuickTime Link files.

Bug eats into Apple security patch software

Ads by Google

Thoughts on this article? Add a comment below.

Be the first to comment on this article.

Report this comment as offensive:

* Indicates information we require to process your submission.

Name: *
Email: *
Reason for offense: *
Your report will not be displayed.

Name:

Email:

(will not be displayed)

Comment:

(HTML not permitted)

Validation

Enter the code you see below:

Product Reviews

	AdventNet ManageEngine The AdventNet Manage-Engine Password Manager Pro provides a complete system for password management in one...

	Cyber-Ark Software Enterprise Password Vault The Cyber-Ark Enterprise Password Vault, or EPV, is a high-end password management powerhouse.

	Hitachi ID Systems ID-Archive The Hitachi ID-Archive sets its focus on password randomisation.

	Lieberman Software Enterprise Random PM The Lieberman Software Enterprise Random Password Manager is a full-on password manager and randomiser for...

	Proginet Corporation SecurForce Proginet SecurForce is a little bit of a horse of a different color for this month's Group Test.