Apple patches QuickTime flaw

Apple has patched a flaw in QuickTime that could allow for remote attacks.

The fix addresses a vulnerability in the Windows Vista and XP versions of QuickTime, which is commonly installed as a browser plug-in or as a component of iTunes. OS X users are not affected.

Apple said that the problem concerns QuickTime Media Links (QTLs) which are often used to launch media files from browsers.

If a specially crafted QTL is launched, QuickTime can allow access to a command line which could then be used to execute malicious code.

Security researcher Petko D Petkov showed last month how a malformed QTL file could be placed within a web page and disguised as a movie or song file.

When clicked, the links would allow for JavaScript code to run with the privileges of the current user.

The researcher provided several proof-of-concept samples which caused vulnerable machines to display alert boxes, launch arbitrary applications and even shut down.

Although the Apple security notice does not specifically mention the report, a spokesperson confirmed to vnunet.com that the fix addresses the flaw described by Petkov.

Users can obtain the update via the Software Update application or from Apple's support site.

See also:

Hackers reopen iPhone hunting season

New trick allows users to reverse killer update  03 Oct 2007

Adobe puts 'iSpin' on mobile Flash

New version of player guns for the iPhone crowd  27 Sep 2007

Hackers exploit widget security holes

Security firm warns of imminent danger  17 Sep 2007

Apple refines iPod line-up

Upgrades range from new colours to video screens  06 Sep 2007

Like this story? Spread the news by clicking below:

 del.icio.us     Digg this     reddit!