Must Read: The HTC One Google Edition? A Sense-less plan, if you ask me

Topic: Hardware

Another QuickTime code execution flaw surfaces

Summary: A security researcher has unearthed a buffer overflow remote code execution vulnerability that affects QuickTime on both the Windows and Mac platform.The flaw was published Thursday by Luigi Auriemma, who has been busy of late, is the latest in a series of QuickTime issues.

Larry Dignan

By for Zero Day |

A security researcher has unearthed a buffer overflow remote code execution vulnerability that affects QuickTime on both the Windows and Mac platform.

The flaw was published Thursday by Luigi Auriemma, who has been busy of late, is the latest in a series of QuickTime issues. Will someone at Apple get us rewrite already?

The QuickTime vulnerability thus far is unpatched. Here are the details courtesy of Auriemma:

The problem is a buffer-overflow which happens during the filling of the LCD-like screen containing info about the status of the connection.

For exploiting this vulnerability is only needed that an user follows a rtsp:// link, if the port 554 of the server is closed Quicktime will automatically change the transport and will try the HTTP protocol on port 80, the 404 error message of the server (other error numbers are valid too) will be visualized in the LCD-like screen.

During my tests I have been able to fully overwrite the return address anyway note that the visible effects of the vulnerability could change during the usage of the debugger (in attaching mode it's everything ok).

The vulnerability impacts versions 7.3.1.70 and lower. Ryan Naraine reports that Symantec DeepInsight has confirmed the vulnerability.

And U.S. CERT has added in a post:

The flaw is in the way that QuickTime handles Real Time Streaming Protocol (RTSP) URL strings. By persuading a user to access a specially crafted QuickTime file, or RTSP stream, a remote attacker may be able to execute arbitrary code or cause a denial of service on a vulnerable system.

Topics: Hardware, Mobility, Security

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

64 comments
Log in or register to join the discussion

  • QuickTIme needs to die...

    Along with the crappy player.
    No_Ax_to_Grind
    Reply Vote

    • Windows should die !!!!!!!

      That's what I always thought . Windows and it's stupid minions should die once and
      for all .
      Intellihence
      Reply Vote

      • You first.

        nt
        Hallowed are the Ori
        Reply Vote

      • Deep thoughts with Leopard Handy...

        Deep indeed. I was moved by your contribution.
        tikigawd
        Reply Vote

      • Reality

        Apple produce extremly bad quality software and as alway does, as more and more clueless clown such as some poster here (see clueless clowm in above post) the bugs is Apple's inferior software is showing up more and more. Quicktime as alway been a pain, non standard and totaly useless and should have never cross from the Apple getto to the real world as the format as never been designed to run on computer, but on apple's toys,
        Mectron
        Reply Vote

      • If we did, they would say we where just copying

        a Mac again; you know, one that had just past away after it's upgrade to Leopard... ;)
        GuidingLight
        Reply Vote

      • it's -> its; fu​cken retard

        ???
        ýlysdexia
        Reply Vote

    • I have to agree

      I do not like QuickTime. I hate software that does not give me a lot of control if I want it. If I could use anything else to play QuickTime content I certainly would.
      Glen.Manages.MVS@...
      Reply Vote

      • try VLC??

        you try VLC by any chance???
        madmax_2069
        Reply Vote

      • Try using QuickTime Alternative.

        I found it when my camera used the .mov extension and I don't have a Mac. I believe this free program is better than the original QT. Get QT Alternative at:
        http://www.free-codecs.com/download/QuickTime_Alternative.htm

        Hope this helps...
        Interested Amateur
        Interested Amateur
        Reply Vote

  • Don't worry

    George doesn't let things like facts or truth get in the way of a good attack when it
    comes to Apple.
    MarcB_z
    Reply Vote

    • I think this was one was posted by Larry Dignan

      At least that's the byline on the post.
      t_mohajir
      Reply Vote

    • who's attacking apple hes pointing out a bug in quick time it does not

      who's attacking apple hes pointing out a bug in quick time it does not matter who it affects it's a bug in there software.
      and by the way there have been many in the same software.
      and thats just stating the facts. not an attack an attack would be to say apple sucks or apple is a sorry company. not just sating a fact.
      and by the way it's not George who wrote this.
      SO.CAL Guy
      Reply Vote

      • What else can you expect from a zealot?

        Apple (in this particular case) is like a religion for this person. He seems to think it's
        some sort of "holy war" to defend the prophet Jobs. He did not even see who wrote the
        article!
        markbn
        Reply Vote

      • Don't worry

        MarcB_z doesn't let things like facts or truth get in the way of a good attack when it comes to George.

        :)
        NonZealot
        Reply Vote

    • They should just rename the program QuickVirus or BugTime (nt)

      :)
      GuidingLight
      Reply Vote

      • i vote for BugTime

        another one that fit the bill is: CrapOS


        The Leopard is an endangered animal and the object of most Safari is to kill leopards.
        Mectron
        Reply Vote

        • How about iBug? Or iFlaw?

          Or since it's QuickTime: iSieve.
          Hallowed are the Ori
          Reply Vote

          • I like QuickHack, myself

            But I would go for iSieve too, if it were up for a vote.
            John Zern
            Reply Vote

  • That's even more damning on Apple

    So you are telling me that Apple created a vulnerability in Quicktime that only targets Windows? NICE COMPANY! One more reason why Apple will never see any of my money. I refuse to support companies that try to sabotage my stuff and that is all I see here: Apple trying to sabotage anyone who [b]dares[/b] to use something other than OS X!
    NonZealot
    Reply Vote
CNET Join | Log In | Privacy | Cookies Close