Apple patches two QuickTime holes

Powered by SC Magazine
 

Java flaws affect Mac and Windows versions.

Apple has released a security update addressing two vulnerabilities in its QuickTime multimedia player.

Mac OS X and Windows versions of the software are both affected, and the flaws could lead to unintentional disclosure of information or the ability to remotely execute malware.

The first fix addresses a flaw in the handling of JavaScript applets that could allow for remote code execution.

The exploit occurs when an attacker directs the user to a web page containing a specially crafted Java applet. The update allows the software to check and prevent the launch of the malformed code.

The second vulnerability also lies within the Java component of QuickTime. Apple said that unpatched versions of QuickTime fail to clear browser memory, possibly allowing a malicious Java applet to capture whatever information is being stored.

Apple's update forces QuickTime to clear the memory before an untrusted applet can be run.

Windows users can download the update from Apple's support website. Mac users can get the update through the OS X Software Update component. 

JavaScript flaws were also at the root of Apple's last QuickTime update. That patch was issued just 11 days after an independent researcher discovered and wrote an exploit for a QuickTime flaw in under 12 hours.  

Late last year, a QuickTime flaw was used to launch a major phishing attack on MySpace.

Copyright ©v3.co.uk


Apple patches two QuickTime holes
 
 
 
Top Stories
Beyond ACORN: Cracking the infosec skills nut
[Blog post] Could the Government's cybercrime focus be a catalyst for change?
 
The iTnews Benchmark Awards
Meet the best of the best.
 
Telstra hands over copper, HFC in new $11bn NBN deal
Value of 2011 deal remains intact.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  39%
 
Your insurance company
  3%
 
A technology company (Google, Facebook et al)
  8%
 
Your telco, ISP or utility
  7%
 
A retailer (Coles, Woolworths et al)
  2%
 
A Federal Government agency (ATO, Centrelink etc)
  20%
 
An Australian law enforcement agency (AFP, ASIO et al)
  14%
 
A State Government agency (Health dept, etc)
  6%
TOTAL VOTES: 1777

Vote
Do you support the abolition of the Office of the Information Commissioner?