Apple has
urged users of its QuickTime media player to
upgrade to the latest version to correct multiple security
flaws attackers could exploit to run insidious code on targeted
machines by luring the user to a malicious Web site.
The French Security Incident Response Team (FrSIRT) rated the
flaws critical in an
0825 advisory. It described the flaws as:
 |
| Apple Quicktime: | Jan. 2:
Apple QuickTime flaw could enable botnets.
Attackers could exploit a new Apple QuickTime flaw to grow their
botnets by tricking users into visiting malicious Web sites, and
then hijacking their machines.
Jan. 24:
Apple fixes critical QuickTime flaw. The
QuickTime flaw was disclosed earlier this month at the start of
The Month of Apple Bugs Project.
File format vulnerabilities: Protecting your
applications. From WMF to the latest Excel file exploits,
it's clear that attacks targeting file format vulnerabilities
are on the rise. In this tip, network security expert Mike
Chapple examines why files have become a tempting vector, and
explores what can be
done. |
|
| |
|
- An integer overflow error that surfaces when the media player
handles malformed 3GP video files.
- A heap overflow error that surfaces when the media player
handles a specially crafted MIDI file.
- A buffer overflow error that occurs when the media player
processes malformed QuickTime movies.
- An ineteger overflow error that occurs when the media player
handled malformed UDTA atoms in movie files.
- A heap overflow error that occurs when the media player
processes malformed PICT files.
- Stack, integer and heap overflow errors that occur when the
media player handles a malformed or specially crafted QTIF
file.
The flaws affect Apple QuickTime 7.1.4 and prior. The solution
is to upgrade to QuickTime 7.1.5.
Apple had previously updated QuickTime in
January to fix a flaw that left users' machines open to bot
infections.
That flaw was disclosed at the start of the year by the
vulnerability researcher known as LMH. The researcher
disclosed a variety of Apple flaws as part of
his "Month of Apple Bugs" project.