News, info, and opinion by Mac users, for Mac users.

January 11, 2008

security

QuickTime is just feeling a little vulnerable right now

Posted Jan. 11, ’08, 9:54 AM PT by Dan Moren
Category | Security

QuickTime is sadQuickTime. It’s like that kid in high school who always got beat up for his lunch money. Just one security problem after another. Yesterday, an Italian security researcher by the name of Luigi Auriemma disclosed a buffer overflow in QuickTime 7.3.1.70 and earlier.

How does it work? If you guessed something to do with our old friend RTSP (Real Time Streaming Protocol) then you, sir (or madam), win a kewpie doll. Here’s how it breaks down: if you try to access an address with RTSP, and that address is invalid, it will try to access it via other protocols, such as HTTP. If that fails, it will display the HTTP error message, which will overflow the buffer and potentially allow the execution of arbitrary code (everybody’s favorite).

The bug supposedly works on OS X and Windows, though I wasn’t able to duplicate it myself (the instructions were a little confusing). No fix is provided, though one would hope that Apple is hard at work at fixing this. I’d also hope Mr. Auriemma released it to Apple before simply publishing it online. In the meantime, remember: don’t go visiting strange RTSP URLs, ‘kay?

[via InformationWeek]


1 Comments

tony said:

I know this isnt a fix but does anyone know if memory randomization in Leopard would help prevent this exploit?

January 11, 2008 10:56 AM

Leave a comment

 



Visit other IDG sites: