QTL vulnerability clould allow attackers to run malicious code
vnunet.com, 02 Jan 2007
Apple's QuickTime software has been hit by a buffer overflow bug that could allow malicious code to be run on Windows and Mac PCs.
The vulnerability uses a specially crafted QTL file to cause a stack-based buffer overflow that allows the execution of arbitrary code.
The problem occurs when an 'src' parameter is created with more than 256 bytes.
"After successful exploitation, control over EIP is gained. This is a simple good-old stack smashing," said the first report of the problem at the Month of Apple Bugs website.
The vulnerability has been successfully exploited in QuickTime version 7.1.3, although previous versions are also expected to be vulnerable.
Security website Secunia warned that the only way for users to protect themselves against the attack is not to open untrusted QTL files.
Vulnerabilities aplenty this year, but little fear among the OS X community
Security firm warns that other sites could be infected
Worm spooks site and tries to cash in on malware
How web services contribute to data headaches
Remote access - Three steps to getting connected
3.4 million UK professionals now work from home – is your company equipped?
Cost benefits of a global collaboration network
This white paper is a must read for organisations looking for evidence of the bottom-line benefits of high-definition video and voice communications
Keep up to date with the latest products, services and technologies from the world's leading IT companies; IThound.com brings you over 6,000 white papers, case studies and analyst reports.
Chris Adams, Office Client product manager for Microsoft UK, explains...
Critics says government proposals to curb illegal downloading are unworkable...
Do you agree?
Have your say on this article