The Mac Observer

Windows QuickTime Zero-day Flaw Discovered

January 10th, 2008 at 2:00 PM - News by Jeff Gamet

A new security flaw in QuickTime 7.3.1 for Windows surfaced on Thursday that apparently lets an attacker take control of remote PCs. The vulnerability was discovered by Italian security researcher Luigi Auriemma who posted proof-of-concept code for the exploit on the Internet, according to InformationWeek.

The alleged flaw takes advantage of a buffer overflow bug that lets an attacker send malicious code when QuickTime attempts to access a Real-Time Streaming Protocol link and port 554 on the server is closed.

Symantec Security Response claimed that the flaw appears to be legit. The companyis vice president of development, Alfred Huger, commented "The proof of concept code only managed to crash the product. But itis a safe assumption that if you can do that you may be able to execute remote code."

So far the flaw appears to impact only the Windows version of QuickTime, and to date there are no known instances of an actual attack based on the vulnerability. The likelihood that Windows users could see an actual attack based on Mr. Auriemmais sample code, however, is higher since he chose to publish his proof-of-concept before contacting Apple.

  • Related Entries
  • Email This
  • Tweet This
  • Jeff Gamet on Twitter
Login. Need an account? Register here.



Auto-login on future visits

Show my name in the online users list

Forgot your password?


Commenting is not available in this section entry.
 

Recent Headlines - Updated November 10th

Tue, 8:16 AM
News - Apple Releases Security Update 2009-006 for Leopard, Snow Leopard
Mon, 7:20 PM
Rumor - Apple May Update iPod touch in December
6:45 PM
Product News - MacUpdate Desktop Updated to 5.0.1 with New Features, Bug Fixes
5:16 PM
Apple Releases Mac OS X 10.6.2 - Guest Account Bug Fixed, Much More
4:12 PM
Games - New For iPhone: Star Rangers, Air Force Supremacy, Blood Beach, More
2:51 PM
Apple Stock Watch - Radio Shack Jumps 14% on iPhone Deal, Apple Up 3%
2:25 PM
Games - EA Scoops Up Social Games Publisher Playfish
1:51 PM
Deal Brothers - Western Digital 1TB SATA Intellipower Hard Drive:  $84.99
10:58 AM
News - StarHub Signs Singapore iPhone Deal
10:36 AM
Hot Forum Topic - Reader Speculation: What’s in Apple’s Tablet?
10:08 AM
News - Apple Kicks Off New Credit Program
9:26 AM
News - Apple Launches Reserve and Pick Up Program
 

The Mac Observer Reader Specials

  • TypeStyler For Mac OS X is Now Shipping! Download The Free Fully Functional 60 Day Tryout at www.typestyler.com
  • RamJet Memory: Mac Pro 8-core 8GB Kit $199.99, 4GB Kits $109.99! Sale on MacBook and MacBook Pro 8GB kits $549.99! New MacBook DDR3 2GB for $49.99. iMac and Mac mini 4GB Kits for $79.99! 1TB SATA Hard Drives for $109.99! Click here
  • OWC: Plug & Play Hardware RAID up to 8.0TB. High Performance, Data Redundant Solutions. FireWire 800, FireWire 400, USB2, or eSATA. Hot Swappable Bays, Data Rates over 200MB/s. Click here
  • Poker Mac If you're using a Mac, then you've gotta check out Full Tilt Poker for Mac. This Full Tilt Poker bonus code does the unthinkable, it actually rewards!
  • For the latest Apple products use Ciao, a price comparison website, to find laptops like MacBook Air. Then find the best prices on MP3 players and use our comparison tool to evaluate mobile phones like the Apple iPhone.

  • Laptop Hardware Provided by TechRestore - Overnight Mac & iPod Repairs.
  • Buy Stuff, Support TMO!
  • __________
  • Macworld Expo 2010 Hotel Deal
  • TMO on Twitter!

Apple Stock Quote

  • AAPL: $201.46. Change: 0.00.
  • (Prices delayed up to 20 minutes.)
  • Discuss in our Apple Finance Board

Hot Topics

TMO Express

Join the TMO Express Daily Newsletter to get the latest Mac headlines in your e-mail every weekday. Find out more!

Top Deals From DealBrothers.com

Recent Features