News, info, and opinion by Mac users, for Mac users.

May 30, 2007

security

YAQTSU: Yet another Quicktime security update (and more)

Posted May. 30, ’07, 3:53 AM PT by Derik DeLong
Category | Security

Quicktime Considering its recent track record, YAQTSU is a phrase we may very well need to become familiar with. Apple introduced Security Update (QuickTime 7.1.6) yesterday. It includes fixes for two issues relating to the Java access afforded by Quicktime.

  • CVE-ID: CVE-2007-2388: Visiting a malicious website may lead to arbitrary code execution
  • CVE-ID: CVE-2007-2389: Visiting a malicious website may lead to the disclosure of sensitive information

More information is found at the update’s web page. This is one of those rare updates that doesn’t force the user into rebooting the computer, so go ahead and kick it off while you keep reading. It was a mere 1.9MB when I downloaded it, but it’s 1.4MB when downloaded for standalone usage.

I hope I’m wrong about this, but I expect we’ll be seeing many more updates like this in coming months. It’s become really clear that the Quicktime to Java bridge is rife with problems.

In other security news, Samba (the software that enables Windows file sharing in Mac OS X) has a vulnerability that exposes Macs to possible buffer overflow exploits. You can try updating it yourself, disabling Windows file sharing, or, my personal favorite, hide your Mac behind a router and any outside connection attempts.


Leave a comment

 



Visit other IDG sites: