QTL vulnerability clould allow attackers to run malicious code
vnunet.com, 02 Jan 2007
Apple's QuickTime software has been hit by a buffer overflow bug that could allow malicious code to be run on Windows and Mac PCs.
The vulnerability uses a specially crafted QTL file to cause a stack-based buffer overflow that allows the execution of arbitrary code.
The problem occurs when an 'src' parameter is created with more than 256 bytes.
"After successful exploitation, control over EIP is gained. This is a simple good-old stack smashing," said the first report of the problem at the Month of Apple Bugs website.
The vulnerability has been successfully exploited in QuickTime version 7.1.3, although previous versions are also expected to be vulnerable.
Security website Secunia warned that the only way for users to protect themselves against the attack is not to open untrusted QTL files.
Vulnerabilities aplenty this year, but little fear among the OS X community
Security firm warns that other sites could be infected
Worm spooks site and tries to cash in on malware
First Looks Editor Ian Williams gets hands on with the Sony Ericsson Xperia X1
Surviving veterans of the code-breaking facility to receive badge of...
Telco begins major rollout in 69 locations across the UK
Do you agree?
Have your say on this article