QuickTime exploit disclosed for 1-week-old version

It didn't take long for an exploit to emerge in Apple QuickTime version 7.5.5.

On Monday, one week after Apple pushed out a security update for the popular media-playing program, resulting in 7.5.5, a fresh exploit was posted to the Milw0rm website.

According to Symantec's DeepSight service, the exploit can create a denial-of-service condition due to an error in the processing of the '<?quicktime type=?>' parameter when handling long strings.

The exploit also can crash iTunes or any program that uses a QuickTime plug-in, Mac security firm Intego said Thursday in a memo.

Based on the existing exploit code, the company rated the risk 'low'.

But Intego said the files containing the strings could handle an additional payload that would allow for the execution of arbitrary code 'with no user interaction, other than an attempt to view a file'.

In lieu of a fix, customers are encouraged to safely browse the web, DeepSight analyst Aaron Adams said in a journal entry. He recommended disabling third-party plug-ins and to run the browser with the least privileges possible.

An Apple spokeswoman did not immediately respond to a request for comment on Thursday.

See original article on scmagazineus.com

Copyright © SC Magazine, US edition

disclosedexploitforquicktimesecurityversion