Security firm F-Secure said that the vulnerability has been confirmed to exist in Mac versions of QuickTime, as well as the QuickTime Alternative codec package.
Apple, which makes and distributes QuickTime, distributed the fix to MySpace which then offered the patch to users who accessed the site with Internet Explorer and a detectible version of QuickTime.
But this move leaves millions of users unprotected, according to F-Secure. Other browsers, including Firefox and Safari, remain exposed, and all sites that allow users to upload QuickTime movies will be vulnerable to the same sort of worm that plagued MySpace.
"With no fix available, the only feasible workaround for these social networking sites, and other websites on the internet, is to completely block users from uploading Apple QuickTime content," said F-Secure.
The QuickTime vulnerability first gained attention early this month when a worm known as QuickSpace began spreading on MySpace.
The worm spreads itself through the profile pages of MySpace users, altering the profiles of anyone who views the infected page and redirecting them to a MySpace phishing site.
This malicious site then uses stolen passwords to propagate spam messages with links to adware-installing sites.
Commons Science and Technology Committee calls for new post-Brexit skilled-workers immigration system
Committee calls for visa-free travel and permit-free work for skilled workers
Eleven 'normal' outer moons, and one described as 'oddball' found circling Jupiter
Scientific discovery has found a quadrillion tonnes of diamonds in the earth's mantle
Mobile payment app makes users' details public by default