dcsimg
 

Apple Vulnerability Project Launches with QuickTime Exploit

By Ryan Naraine  |  Print this article Print
 
 
 
 
 
 
 

WEBINAR:
On-Demand

Re-Imagining Linux Platforms to Meet the Needs of Cloud Service Providers


The first flaw in the Apple bug-a-day project is an easy-to-exploit QuickTime issue that puts millions of Mac and Windows users at risk of code execution attacks.

An easy-to-exploit security vulnerability in Apple Computer's QuickTime media player could put millions of Macintosh and Windows users at risk of code execution attacks.

The QuickTime flaw kicked off the Month of Apple Bugs project, which promises to expose unpatched Mac OS X and Apple application vulnerabilities on a daily basis throughout the month of January.

According to an advisory released Jan. 1, the flaw exists in the way QuickTime handles a specially rigged "rtsp://" URL.

"By supplying a specially crafted string, [an] attacker could overflow a stack-based buffer, using either HTML, Javascript or a QTL file as attack vector, leading to an exploitable remote arbitrary code execution condition," said LMH, one of the mysterious hackers behind the controversial project.

He described exploitation of the issue as "trivial" and warned that stack NX can also be rendered useless.

LMH said the issue was successfully exploited in QuickTime Player Version 7.1.3. Previous versions are likely vulnerable as well. Both Microsoft Windows and Mac OS X versions are affected.

The Cupertino, Calif.-based Apple markets QuickTime as a platform for the handling of video, sound, animation, graphics, text and music. The technology—and media player—is available for Windows and Mac users, making it a lucrative target for malware writers.

"The only potential workaround would be to disable the "rtsp://" URL handler, uninstalling QuickTime or simply live with the feeling of being a potential target," according to the advisory.

Check out eWEEK.com's Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at Ryan Naraine's eWEEK Security Watch blog.

 
 
 
 
 
 
 
 
 
























By submitting your information, you agree that channelinsider.com may send you channelinsider offers via email, phone and text message, as well as email offers about other products and services that channelinsider believes may be of interest to you. channelinsider will process your information in accordance with the Quinstreet Privacy Policy.

 
 
 
 
 
 

Submit a Comment

Loading Comments...
























By submitting your information, you agree that channelinsider.com may send you channelinsider offers via email, phone and text message, as well as email offers about other products and services that channelinsider believes may be of interest to you. channelinsider will process your information in accordance with the Quinstreet Privacy Policy.

 
 
 
 
 
 
 
 
 
Thanks for your registration, follow us on our social networks to keep up-to-date