toggle

AAPL Stock: 126.44 ( -0.16 )

Printed from http://www.macnn.com

SonicWALL blocks QuickTime zero-day exploit

updated 04:45 pm EST, Thu November 29, 2007

SonicWALL Quicktime issue

Networking security hardware manufacturer SonicWALL recently announced that it has distributed defensive measures to users of it's Unified Threat Management technology, against zero-day vulnerability exploits found in QuickTime. Malicious websites are able to create a stack-based buffer overflow in Apple's media player, by providing a phony movie file that, when activated, executes a series of code that allows a users machine to be taken over. SonicWALL says that the problem lies within the "Content-Type" header field that is sent from the server, which is not properly verified by the client's QuickTime. Once the "Content-Type" field reaches a certain length, a Buffer Overflow condition occurs, and through this, malevolent users can rewrite a user's privileges so that they have read-write access to the machine.

The company says that both Mac OS- and Windows-based users are vulnerable to the threat, since QuickTime and iTunes - which uses QuickTime's media infrastructure - are available for both platforms.

Recently, Heiss Security found a flaw in Leopard's quarantine system - a new dialogue that interrupts users when they launch a freshly downloaded file or applications to ensure they indeed would like to open it. While the flaw doesn't assuredly grant access to Mac OS X's inner workings, it does allow for arbitrary execution of commands in terminal, which can do anything from deleting a users files, to implementing a trojan.




by MacNN Staff

toggle

Comments

Login Here

Not a member of the MacNN forums? Register now for free.

toggle

Network Headlines

Follow us on Facebook

toggle

Most Popular

Advertisement

Recent Reviews

Prong PWR Case

Ultimately there's one thing we all want from smartphone accessories; we want options. When it comes to keeping our iPhone charged, w ...

iHome iBT74 Color Changing Bluetooth Speaker

There's no reason why your tech can't look good while doing what it was designed to do. That's the reason that sports cars look goo ...

Logitech Gaming Daedalus Prime Mouse

Logitech Gaming continues to expand upon its peripherals line, with each one looking to fit neatly into a breadth of gaming needs. Bui ...

toggle

Most Commented