QuickTime flaw could go beyond MySpace

The QuickTime security hole that enabled a phishing worm to attack users of social networking site MySpace is leaving more users and websites vulnerable than was first thought.

Security firm F-Secure said that the vulnerability has been confirmed to exist in Mac versions of QuickTime, as well as the QuickTime Alternative codec package.

"Any malicious JavaScript code exploiting [the vulnerability] would affect the users of both operating systems," said F-Secure researcher S G Masood.

Apple, which makes and distributes QuickTime, distributed the fix to MySpace which then offered the patch to users who accessed the site with Internet Explorer and a detectible version of QuickTime.

But this move leaves millions of users unprotected, according to F-Secure. Other browsers, including Firefox and Safari, remain exposed, and all sites that allow users to upload QuickTime movies will be vulnerable to the same sort of worm that plagued MySpace.

"With no fix available, the only feasible workaround for these social networking sites, and other websites on the internet, is to completely block users from uploading Apple QuickTime content," said F-Secure.

The QuickTime vulnerability first gained attention early this month when a worm known as QuickSpace began spreading on MySpace.

The worm spreads itself through the profile pages of MySpace users, altering the profiles of anyone who views the infected page and redirecting them to a MySpace phishing site.

This malicious site then uses stolen passwords to propagate spam messages with links to adware-installing sites.