Apple fixes HTTP-response vulnerability in QuickTime

Apple fixed a bug in OS X versions 10.3.9, 10.4.9, 10.5 or later as well as Windows Vista and XP with Service Pack 2. The bug could allow application termination or arbitrary code execution.

The heap buffer overflow vulnerability exists in QuickTime's handling of HTTP responses when RTSP tunnelling is enabled. The flaw, discovered last month by researcher Luigi Auriemma, can be exploited when an end-user visits a maliciously crafted webpage.

Secunia, a Copenhagen-based vulnerability monitoring organisation, had ranked the flaw “highly critical,” meaning that it was a zero-day bug, but no exploit was seen in the wild.

FrSIRT, the French Security Incident Response Team, called the flaw “critical” in the sense that it can be exploited from a remote location.

US-CERT also warned users about the flaw last month, providing a number of workarounds while advising users to avoid links including URL encoding, IP address variations, long URLs and intentional misspellings.

Apple fixed four other bugs in the release of QuickTime 7.4 in the days following the HTTP bug's disclosure.

See original article on scmagazineus.com

Copyright © SC Magazine, US edition

security