Severity: High
3 April, 2008
Summary:
- This vulnerability affects: QuickTime 7.4.x for Mac and PC (and possibly earlier versions)
- How an attacker exploits it: Multiple methods of attack; in the most common, users are enticed to download and play a malicious movie or image in QuickTime
- Impact: Various results; in the worst case, an attacker executes code on your user’s computer, potentially gaining complete control of it
- What to do: If you allow QuickTime (or iTunes), upgrade to 7.4.5 — otherwise, remove these applications from your company’s computers
Exposure:
Today, Apple released an alert fixing eleven vulnerabilities in their popular media player application, QuickTime. (Current versions of iTunes also ship with QuickTime; if your users have iTunes, they most likely have QuickTime.) These applications run on Windows and Macintosh computers, and both platforms are susceptible to exploitation of these security flaws. Apple’s alert specifies Vista and XP SP2 as the vulnerable versions of Windows.
The vulnerabilities relate to different processes in QuickTime. For example: How it opens a picture file, how it displays movie files, how it handles a movie’s media tracks, and so on. Some of these vulnerabilities allow attackers to execute any code they choose on your OS X machines, so we rate this update Critical. If you allow QuickTime, apply the update as soon as you can. Some of the vulnerabilities fixed include:
Severity: High
3 April, 2008
Summary:
- This vulnerability affects: QuickTime 7.4.x for Mac and PC (and possibly earlier versions)
- How an attacker exploits it: Multiple methods of attack; in the most common, users are enticed to download and play a malicious movie or image in QuickTime
- Impact: Various results; in the worst case, an attacker executes code on your user’s computer, potentially gaining complete control of it
- What to do: If you allow QuickTime (or iTunes), upgrade to 7.4.5 — otherwise, remove these applications from your company’s computers
Exposure:
Today, Apple released an alert fixing eleven vulnerabilities in their popular media player application, QuickTime. (Current versions of iTunes also ship with QuickTime; if your users have iTunes, they most likely have QuickTime.) These applications run on Windows and Macintosh computers, and both platforms are susceptible to exploitation of these security flaws. Apple’s alert specifies Vista and XP SP2 as the vulnerable versions of Windows.
The vulnerabilities relate to different processes in QuickTime. For example: How it opens a picture file, how it displays movie files, how it handles a movie’s media tracks, and so on. Some of these vulnerabilities allow attackers to execute any code they choose on your OS X machines, so we rate this update Critical. If you allow QuickTime, apply the update as soon as you can. Some of the vulnerabilities fixed include:
- Multiple movie handling code execution vulnerabilities. QuickTime suffers from five vulnerabilities (mostly buffer overflow flaws) involving the way it handles opening movie files. While the vulnerabilities differ technically, they all share the same scope and impact. If an attacker can get one of your users to open a maliciously crafted movie, he could trigger any of these flaws to execute code on your user’s computer, with the same privileges and permissions your user has.
- Multiple image handling code execution vulnerabilities. QuickTime suffers from three buffer overflow vulnerabilities involving the way it handles .PICT image files. Like the movie flaws above, these three vulnerabilities differ technically but share the same scope and impact. By enticing one of your users to open a maliciously crafted .PICT image in QuickTime, an attacker could exploit any of these flaws to execute code on your user’s Mac, with that user’s privileges.
- VR Movie buffer overflow vulnerability. Quicktime supports QuickTime Virtual Reality (VR), or QTVR image files, which are panoramic images stitched together into one special image file which QuickTime allows you to explore in simulated 3-D. Unfortunately, QuickTime suffers from a buffer overflow vulnerability involving the way it handles a specially crafted QTVR image. If an attacker lures one of your users into viewing a malicious QTVR image, he could exploit this flaw to execute code on that user’s computer, with that user’s privileges.
The remaining flaws in Apple’s QuickTime alert include another code execution flaw in addition to those described above, and an information disclosure vulnerability. If you’d like to know more about any of these QuickTime flaws, refer to Apple’s alert.
Solution Path:
Apple has released QuickTime version 7.4.5 to correct these flaws. If you allow QuickTime or iTunes in your network (or suspect that your users have installed them), we recommend that users either remove the applications or install version 7.4.5.
The latest versions of QuickTime and iTunes for Windows ship with Apple Software Update. Apple Software Update automatically detects updates such as this one for QuickTime, and then informs you, so that you can install it as soon as possible. If you choose to allow QuickTime or iTunes in your network, we recommend you set Apple Software Update to check for new updates daily and allow it to assist you in keeping your Apple software current.
Notes: Apple recently used Software Update to push Safari 3.1 onto Windows computers that did not have Safari installed. If you do not want to install Safari on your computers, be sure to uncheck the Safari 3.1 update option. Also, Apple ships QuickTime combined with iTunes by default. If you do not want iTunes, there is a standalone version of QuickTime which you can download instead.
For All Users:
These attacks rely on getting one of your users to download and open any of several different QuickTime movie or image file types. Many of these multimedia formats have legitimate business uses and should not be blocked categorically at your firewall. Unless you want to block all of the media types that QuickTime supports, you should insist that users either remove QuickTime and iTunes, or install Apple’s QuickTime update as soon as possible.
Status:
Apple released QuickTime 7.4.5, which fixes this issue.