Contact Us Today! (215) 853-2266

Bardissi Enterprises Blog

Bardissi Enterprises has been serving the Hatfield area since 2000, providing IT Support such as technical helpdesk support, computer support, and consulting to small and medium-sized businesses.

Quicktime Hammered by Four Multimedia File Vulnerabilities

Severity: High

15 January, 2008

Summary:

  • This vulnerability affects: Quicktime 7.3.1.70 for Mac and PC (and possibly earlier versions)
  • How an attacker exploits it: By enticing your users to download and play a malicious movie or image in Quicktime
  • Impact: Attacker executes code on your user’s computer, potentially gaining complete control of it
  • What to do: If you allow Quicktime (or iTunes), upgrade to 7.4. Otherwise, remove these applications from your company’s computers

Severity: High

15 January, 2008

Summary:

  • This vulnerability affects: Quicktime 7.3.1.70 for Mac and PC (and possibly earlier versions)
  • How an attacker exploits it: By enticing your users to download and play a malicious movie or image in Quicktime
  • Impact: Attacker executes code on your user’s computer, potentially gaining complete control of it
  • What to do: If you allow Quicktime (or iTunes), upgrade to 7.4. Otherwise, remove these applications from your company’s computers

Exposure:

Today, Apple released an alert fixing four vulnerabilities in their popular media player application, Quicktime. (Current versions of iTunes also ship with Quicktime; if your users have iTunes, they most likely have Quicktime.) These applications run on Windows and Macintosh computers, and both platforms are susceptible to exploitation of these security flaws. Apple’s alert specifies Vista and XP SP2 as the vulnerable versions of Windows.

The vulnerabilities relate to different processes in Quicktime (for example, how it opens a picture file, how it displays movie files, how it handles Macintosh Resource records, and so on), but the flaws share a similar result if successfully exploited. If an attacker can get one of your users to open a maliciously crafted movie or image file, he could trigger any of these flaws to execute code on your user’s computer, with the same privileges and permissions your user has. If your users have local administrative privileges, the attacker could gain complete control of their machines.

Last week, we reported a zero day Quicktime vulnerability involving RTSP streams. We have tested the Proof-of-Concept (PoC) exploit for that vulnerability against the Quicktime update Apple released today; unfortunately, this update does not fix that previously reported issue. Whether or not you install today’s Quicktime update, you should still follow the workarounds described in our previous alert to protect yourself from the zero day RTSP Quicktime flaw.

Solution Path:

Apple has released Quicktime version 7.4 (or iTunes 7.6) to correct these flaws. If you allow (or suspect that your users have installed) Quicktime or iTunes in your network, we recommend that users either remove the applications or install version 7.4.

The latest versions of Quicktime and iTunes for Windows ship with Apple Software Update. Apple Software Update automatically detects updates such as this one for Quicktime, then informs you, so that you can install it as soon as possible. If you choose to allow Quicktime or iTunes in your network, we recommend you set Apple Software Update to check for new updates daily and allow it to assist you in keeping your Apple software current.

Note: By default, Apple ships Quicktime combined with iTunes. If you do not want iTunes, download the standalone version of Quicktime.

For All Users:

These attacks rely on one of your users downloading and opening any of several different Quicktime movie or image file types. Many of these multimedia formats have legitimate business uses and should not be blocked in their entirety at your firewall. Unless you want to block all the media types that Quicktime supports, you should insist that users either remove Quicktime and iTunes, or install Apple’s Quicktime update as soon as possible.

Status:

Apple released Quicktime 7.4, which fixes this issue.

References:

Apple security updates

 

Comments

No comments made yet. Be the first to submit a comment
Already Registered? Login Here
Guest
Friday, 22 November 2024
If you'd like to register, please fill in the username, password and name fields.

Captcha Image

Mobile? Grab this Article!

QR-Code dieser Seite

Blog Archive

Recent Comments

Tip of the Week: Which Headphones are Right for Your Needs?
23 April 2018
I will recommend Plantronics Backbeat Pro 2 SE Noise cancelling Headset with it's Great features.
Gamification: Make Business Fun for Everyone
27 January 2017
The world is based on the games. There are many types of games as per the aussie essay writing servi...
Let's Talk Tablets
12 January 2017
The concept of tablet is far better than that of PC because you can bring them with you everywhere a...
Tip of the Week: Tweak Your Workday in These 4 Ways and See Major Results
12 January 2017
The only thing will I will say regarding this blog is that it is very helpful at least for me. As I ...
WatchGuard Releases Version 10.2.7 for WSM, Edge, Fireware, and Fireware Pro
23 December 2016
I really needed to know about the fireware but i was confused that where can i find information abou...