Apple QuickTime exploit goes wild

By

Attackers have begun targeting an unpatched flaw in Apple's QuickTime multimedia player..

Apple QuickTime exploit goes wild
The flaw was disclosed in November by independent researcher Kristian Kloskowski, but exploits had existed only as non-malicious proof-of-concept files until now.

Researchers at Symantec reported that an exploit for the vulnerability was discovered on a pornographic website over the weekend. The security firm believes that other sites are also serving the attack.

The vulnerability lies in the way QuickTime handles Real Time Streaming Protocol (RTSP) data from streaming media files. A specially crafted file could cause the player to crash and allow an attacker to remotely execute code.

Symantec said that attackers have placed the exploit on a separate site from the page which triggers the attack.

When the user visits the pornographic site, a small iframe tag within the HTML code redirects the user to the exploit site, which then launches the RTSP attack and installs malware on the user's system.

Symantec urged users to turn their browsers to the highest security settings and use a player other than QuickTime to run streaming media files. Advanced users can also set their firewalls to block outgoing traffic from common RTSP ports.

Apple has yet to release an update to patch the flaw. The company has a policy of not commenting on security vulnerabilities until a fix has been issued.
Got a news tip for our journalists? Share it with us anonymously here.
Copyright ©v3.co.uk
Tags:

Most Read Articles

India's alarm over Chinese spying rocks CCTV makers

India's alarm over Chinese spying rocks CCTV makers

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

Cyber companies hope to untangle weird hacker codenames

Cyber companies hope to untangle weird hacker codenames

Woolworths' CSO is Optus-bound

Woolworths' CSO is Optus-bound

Log In

  |  Forgot your password?