The bug was detected at the start of the year, as part of the Month of Apple Bugs project. Security companies, including Secunia and FrSirt, described the flaw as highly critical, yet it has taken the IT giant 23 days to patch.
One of the researchers behind the project, a former hacker known as LMH, said he was stunned by the length of time it took Apple to fix the bug.
Taking 23 days for a remote issue that leads to code execution right away is insane, he said in a statement. There was already an exploit and it was being abused in targeted attacks.
The QuickTime vulnerability affects the way the media player runs the Real Time Streaming Protocol (RTSP).
A hacker could exploit the bug and compromise the user's computer by inserting a RTSP string in a QuickTime file, causing the user to open the file, according to an advisory on Apple's website.
The patch is available to download from the company's website or using the Mac OS X software update.
Apple finally releases patch for QuickTime flaw
By
Fiona Raisbeck
on Jan 25, 2007 7:46AM
