Apple Plugs Security Holes in QuickTime
Apple has update QuickTime, fixing a number of remote code execution flaws. One security researcher expects malware writers to launch exploits via drive-by attacks. A new version of QuickTime plugs security holes that leave users open to remote code execution attacks by hackers.
In version 7.6, Apple covered seven such flaws that could be exploited by malicious media files or other techniques. The upgrade is available for Mac OS X v10.4.9 - v10.4.11 and Mac OS X v10.5 or later, as well as Microsoft Windows Vista and Windows XP SP2 and SP3.
Several of the bugs invovle heap buffer overflows. One lies in QuickTime’s handling of RTSP (Real Time Streaming Protocol) URLs. According to the advisory, accessing a rogue RTSP URL may lead to a crash or arbitrary code execution.
