Severity: High
3 April, 2008
Summary:
- This vulnerability affects: QuickTime 7.4.x for Mac and PC (and possibly earlier versions)
- How an attacker exploits it: Multiple methods of attack; in the most common, users are enticed to download and play a malicious movie or image in QuickTime
- Impact: Various results; in the worst case, an attacker executes code on your user’s computer, potentially gaining complete control of it
- What to do: If you allow QuickTime (or iTunes), upgrade to 7.4.5 — otherwise, remove these applications from your company’s computers
Exposure:
Today, Apple released an alert fixing eleven vulnerabilities in their popular media player application, QuickTime. (Current versions of iTunes also ship with QuickTime; if your users have iTunes, they most likely have QuickTime.) These applications run on Windows and Macintosh computers, and both platforms are susceptible to exploitation of these security flaws. Apple’s alert specifies Vista and XP SP2 as the vulnerable versions of Windows.
The vulnerabilities relate to different processes in QuickTime. For example: How it opens a picture file, how it displays movie files, how it handles a movie’s media tracks, and so on. Some of these vulnerabilities allow attackers to execute any code they choose on your OS X machines, so we rate this update Critical. If you allow QuickTime, apply the update as soon as you can. Some of the vulnerabilities fixed include: