Security firm F-Secure said that the vulnerability has been confirmed to exist in Mac versions of QuickTime, as well as the QuickTime Alternative codec package.
Apple, which makes and distributes QuickTime, distributed the fix to MySpace which then offered the patch to users who accessed the site with Internet Explorer and a detectible version of QuickTime.
But this move leaves millions of users unprotected, according to F-Secure. Other browsers, including Firefox and Safari, remain exposed, and all sites that allow users to upload QuickTime movies will be vulnerable to the same sort of worm that plagued MySpace.
"With no fix available, the only feasible workaround for these social networking sites, and other websites on the internet, is to completely block users from uploading Apple QuickTime content," said F-Secure.
The QuickTime vulnerability first gained attention early this month when a worm known as QuickSpace began spreading on MySpace.
The worm spreads itself through the profile pages of MySpace users, altering the profiles of anyone who views the infected page and redirecting them to a MySpace phishing site.
This malicious site then uses stolen passwords to propagate spam messages with links to adware-installing sites.
QuickTime flaw could go beyond MySpace
By Shaun Nichols on Dec 13, 2006 9:06AM
The QuickTime security hole that enabled a phishing worm to attack users of social networking site MySpace is leaving more users and websites vulnerable than was first thought.
Got a news tip for our journalists? Share it with us anonymously here.