Apple fixes HTTP-response vulnerability in QuickTime

By

Apple on Wednesday released a new version of its QuickTime media player, patching a flaw in the application on both Windows and Mac OS X operating systems.


Apple fixed a bug in OS X versions 10.3.9, 10.4.9, 10.5 or later as well as Windows Vista and XP with Service Pack 2. The bug could allow application termination or arbitrary code execution.

The heap buffer overflow vulnerability exists in QuickTime's handling of HTTP responses when RTSP tunnelling is enabled. The flaw, discovered last month by researcher Luigi Auriemma, can be exploited when an end-user visits a maliciously crafted webpage.

Secunia, a Copenhagen-based vulnerability monitoring organisation, had ranked the flaw “highly critical,” meaning that it was a zero-day bug, but no exploit was seen in the wild.

FrSIRT, the French Security Incident Response Team, called the flaw “critical” in the sense that it can be exploited from a remote location.

US-CERT also warned users about the flaw last month, providing a number of workarounds while advising users to avoid links including URL encoding, IP address variations, long URLs and intentional misspellings.

Apple fixed four other bugs in the release of QuickTime 7.4 in the days following the HTTP bug's disclosure.

See original article on scmagazineus.com
Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, US edition
Tags:

Most Read Articles

NSW Police to embark on $126m IT overhaul

NSW Police to embark on $126m IT overhaul

CBA looks to GenAI to assist 1200 'security champions'

CBA looks to GenAI to assist 1200 'security champions'

Victoria's first government tech chief steps down

Victoria's first government tech chief steps down

Australia's super funds told to assess authentication controls

Australia's super funds told to assess authentication controls

Log In

  |  Forgot your password?