Security Architecture, Endpoint/Device Security, Endpoint/Device Security, Security Strategy, Plan, Budget, Vulnerability Management, Patch/Configuration Management, Endpoint/Device Security, Endpoint/Device Security, Endpoint/Device Security

Apple fixes HTTP-response vulnerability in QuickTime

Apple on Wednesday released a new version of its QuickTime media player, patching a flaw in the application on both Windows and Mac OS X operating systems.

The technology giant fixed a bug in OS X versions 10.3.9, 10.4.9, 10.5 or later as well as Windows Vista and XP with Service Pack 2. The bug could allow application termination or arbitrary code execution.

The heap buffer overflow vulnerability exists in QuickTime's handling of HTTP responses when RTSP tunneling is enabled. The flaw, discovered last month by researcher Luigi Auriemma, can be exploited when an end-user visits a maliciously crafted webpage.

Secunia, a Copenhagen-based vulnerability monitoring organization, had ranked the flaw “highly critical,” meaning that it was a zero-day bug, but no exploit was seen in the wild.

FrSIRT, the French Security Incident Response Team, called the flaw “critical” in the sense that it can be exploited from a remote location.

US-CERT also warned users about the flaw last month, providing a number of workarounds while advising users to avoid links including URL encoding, IP address variations, long URLs and intentional misspellings.

Apple fixed four other bugs in the release of QuickTime 7.4 in the days following the HTTP bug's disclosure.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.