Vulnerabilities within QuickTime?

Sunnz · #1 January 4th, 2007, 04:54 AM

On a FreeBSD mailing list, someone quoted Apple:

Quote:

The Apple Security Team reports that there are multiple
vulnerabilities within QuickTime (one of the plugins for
win32-codecs). A remote attacker capable of creating a malicious SGI
image, FlashPix, FLC movie, or a QuickTime movie can possibly lead to
execution of arbitrary code or cause a Denial of Service (application
crash).

Users who have QuickTime (/win32-codecs) as a browser plugin may be
vulnerable to remote code execution by visiting a website containing a
malicious SGI image, FlashPix, FLC movie or a QuickTime movie.

Of course, they are most concerned with win32codecs on their OS...

So, what about OSX? Do we have this vulnerability in the pre-installed quicktime as well? Did Apple really announced this? Does anyone know if there is an official Apple Security Advisory list?

**fryke** · #2 January 4th, 2007, 04:59 AM

I'm not sure about this particular bug, but January 2007 _is_ "month of apple bugs" here -> http://projects.info-pull.com/moab/ ... Should be interesting.

Apple _does_ release information and security updates on this page: http://docs.info.apple.com/article.html?artnum=61798 ... There are links to updates and descriptions etc., although this, of course, only gets released when an update is available as well.

Sunnz · #3 January 4th, 2007, 05:24 AM

Hmm... aren't they the same people who "proved" MacBook's wireless vulnerability... not using the internal Airport but a 3rd party wifi card?

Sunnz · #4 January 4th, 2007, 06:00 AM

Anyway, found a link about QT 7.1.3 from Apple: http://docs.info.apple.com/article.html?artnum=304357

**fryke** · #5 January 4th, 2007, 06:20 AM

Even _if_ those are the same guys, doesn't make the bugs go away.

I really hope Apple uses this "MOAB" thing for their own good, fixing things promptly and responding in a timely fashion.
So far, they've only kinda "welcomed" the MOAB. But nothing more about it.

Sunnz · #6 January 4th, 2007, 09:05 AM

Well, guess what? Landon Fuller, a programmer, Darwin developer, and former engineer in Apple's BSD Technology Group, comes to rescue!!!

http://landonf.bikemonkey.org/code/macosx

Basically he's gotta to squat each MOAB as they are released.

**fryke** · #7 January 4th, 2007, 02:32 PM

nice.

... although i _still_ hope that Apple will answer the MOAB appropriately. Maybe they can simply take the fixes and implement them, so they can release one security update at the end of the month.

lurk · #8 January 4th, 2007, 07:24 PM

I wonder about the ground rules on this though, Day 2 was a bug in VLC that is not really an Apple bug is it? I mean if that is the case we could fill up the rest of the month with Word alone ;-)

// Computer brand loyalty is teh kewl!