February 6, 2008 1:56 PM PST
Apple updates QuickTime security
On Wednesday, Apple released QuickTime 7.4.1. The update is for users of Mac OS X v10.3.9, Mac OS X v10.4.7, Mac OS X v10.5 or later, and Windows Vista and Windows XP SP2. It addresses the vulnerability described in CVE-2008-0234.
By enticing a user to visit a maliciously crafted Web page, Apple says that an attacker may use an unpatched version of QuickTime to cause an unexpected application termination or arbitrary code execution. The vulnerability is a heap buffer overflow that exists in QuickTime's handling of HTTP responses when RTSP tunneling is enabled. Apple did not credit a researcher for reporting this vulnerability.
As CNET's resident security expert, Robert Vamosi has been interviewed on the BBC, CNN, MSNBC, and other outlets to share his knowledge about the latest online threats and to offer advice on personal and corporate security. Listen to his podcast at securitybites.cnet.com or e-mail Robert with your questions and comments.
- Topics:
-
Audio and video,
-
Security
- Share:
- Digg
- Del.icio.us
If, however, you go to Apple's site's Quicktime page, sure enough, there it is: 7.4.1 for Windows.
Grrr.
AWM
Almost One vuln a month for every month it's been released.
with them. Apple released this patch for OSX *and* winblows, it's
all Apple.
What do you want to prosecute them for again? I love defending
Apple, but even I have to admit it's hard to defend Quicktime.
Sometimes I wonder if M$ actually developed it, with all the
security bugs it has had. But I'm not sure it's a prosecutable
offense, unless you're willing to hang M$ at the gallows first.