apple news/media reports
11/26/2007, 11:30am, EST
Monday, November 26th
New QuickTime buffer vulnerability exposed
A new vulnerability in the QuickTime media player has been exposed, says the computer security firm Secunia. The group has just issued a fresh advisory, which points out that a boundary error can be created when processing RTSP replies, simply by using an overly long "Content-Type" header. This in turn leads to a stack-based buffer overflow, which grants attackers the ability to launch arbitrary code. The vulnerability is only confirmed to work on QuickTime 7.3 at present, however, and requires victims to open a QTL file or visit a malicious website.
Secunia does caution that other versions of QuickTime may be exposed, and that the exploit is already out in public. Since Apple has yet to respond to the problem, QuickTime users are warned to avoid unfamiliar links and websites, and never open QTL files from untrusted sources.
, 
, 5
, 
, 
, 
, 
, 
, 
Top
subscribe to comments
for this article
W
W
But leopard's library randomization has lot's of flaws in it that don't make it as helpful as it could be.
People - this is nothing. And when SHOULDN'T Windows users be concerned, testicular? The fact they use Windows should be cause for normal people to be concerned for them.
Doofuses.
W