Severity: High
13 December, 2007
Summary:
- This vulnerability affects: Quicktime 7.3 for Mac and PC (and possibly earlier versions)
- How an attacker exploits it: By enticing your users to download and play a malicious Quicktime media file
- Impact: Attacker executes code on your user’s computer, potentially gaining complete control of it
- What to do: If you allow Quicktime (or iTunes), upgrade to 7.3.1. Otherwise, remove these applications from your company’s computers.
Severity: High
13 December, 2007
Summary:
- This vulnerability affects: Quicktime 7.3 for Mac and PC (and possibly earlier versions)
- How an attacker exploits it: By enticing your users to download and play a malicious Quicktime media file
- Impact: Attacker executes code on your user’s computer, potentially gaining complete control of it
- What to do: If you allow Quicktime (or iTunes), upgrade to 7.3.1. Otherwise, remove these applications from your company’s computers.
Exposure:
Today, Apple released an alert fixing three vulnerabilities in their popular media player application, Quicktime. (Current versions of iTunes also ship with Quicktime; if your users have iTunes, they most likely have Quicktime.) These applications run on Windows and Macintosh computers, and both platforms are susceptible to exploitation of these security flaws. Apple’s alert specifies Vista and XP SP2 as the vulnerable versions of Windows.
Though they differ technically, the three vulnerabilities all relate to the way Quicktime improperly handles different types of multimedia — and the results of the exploits are similar. If an attacker can get one of your users to open a maliciously crafted multimedia file, he could trigger any of these flaws to execute code on your user’s computer, with the same privileges and permissions your user has. If your users have local administrative privileges, the attacker could gain complete control of their machines. The primary difference of note between these flaws involves which media file the attacker can use to exploit them. The potentially dangerous files that could trigger these flaws are:
- RTSP movies (.rtsp)
- QTL files (.qtl)
- Flash media (.swf, .fla)
Solution Path:
Apple has released Quicktime version 7.3.1 to correct these flaws. If you allow (or suspect that your users have installed) Quicktime or iTunes in your network, we recommend that users either remove the applications or install version 7.3.1.
The latest versions of Quicktime and iTunes for Windows ship with Apple Software Update. Apple Software Update automatically detects updates such as this one for Quicktime, then informs you, so that you can install the update as soon as possible. If you choose to allow Quicktime or iTunes in your network, we recommend you set Apple Software Update to check for new updates daily and allow it to assist you in keeping your Apple software current.
Note: By default, Apple ships Quicktime combined with iTunes. If you do not want iTunes, download the standalone version of Quicktime.
For All Users:
These attacks rely on one of your users downloading and opening any of several different file types. You can mitigate the risk of these vulnerabilities by configuring your WatchGuard Firebox to block the following file types using its SMTP and HTTP proxies:
- .rtsp
- .qtl
- .swf
- .fla
Note that blocking these file types will prevent your users from downloading them, whether the files are legitimate or malicious. Some of these file formats have legitimate business uses, and you may not want to block them in their entirety at your firewall. Whether you decide to block these file types or not, you should insist that users either remove Quicktime and iTunes, or install Apple’s Quicktime update as soon as possible.
If you want to block these media files using your Firebox’s SMTP and HTTP proxies, refer to the links below:
- Firebox X Edge running 8.5 or later
- Firebox III and X Core running WFS
- Firebox X Core and X Peak running Fireware Pro
Status:
Apple released Quicktime 7.3.1, which fixes this issue.