Unpatched QuickTime-to-Firefox flaw dings IE too
Summary: Security researcher Aviv Raff has found a way to use the one-year-old (and still unpatched) QuickTime vulnerability to automate XAS (cross application scripting) attacks against users of Microsoft's Internet Explorer.
Security researcher Aviv Raff has found a way to use the one-year-old (and still unpatched) QuickTime vulnerability to automate XAS (cross application scripting) attacks against users of Microsoft's Internet Explorer.
To demonstrate the attack scenario, Raff embedded a rigged QuickTime file on Google's BlogSpot to force a Skype shutdown if an IE user is tricked into visiting that Web page. Any limited Web environment that allows embedded QuickTime files can be used to host an attack against IE, Raff said.
This attack uses the same vulnerability disclosed earlier this week by Petko D. Petkov (pdp) that could be used to launch code execution attacks on Windows users if Firefox is set as the default browser.
[ GALLERY: How to run Internet Explorer securely ]
Raff is very familiar with this vulnerability. Earlier this year, during the Month of Apple Bugs project, Raff expanded on Petkov's earlier discovery and published an exploit (MOAB #3) to show how booby-trapped QuickTime files can remotely execute harmful code against Windows users.
Interestingly, Apple patched Raff's MOAB flaw with QuickTime 7.1.5 (even crediting the project in its advisory) but it's now clear that the fix was inadequate. "It wasn't fully fixed," Raff said, noting that QuickTime still allows protocol handlers from external Web sites.
[SEE: One-year-old QuickTime bug comes back to bite Firefox ] Apple does not respond to queries on specific security vulnerabilities.
The company has also been very tardy on supplying a fix for a code execution flaw in its Java runtime implementation. That flaw, rated critical by security experts, was first reported more than 10 months ago.
Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.
Talkback
Simple solution
Solution: Uninstall, and never reinstall.
Or
Simple.
You might as well say...
Simple
You may be on to something.
contrary. Maybe you have something there worth thinking about more.
I've given up cable and after the initial shock I have found that I'm actually happier
not having the filth streaming into my living room.
Right
Wow
What I actually meant was that as a network administrator, I would be out of a job if I decided to just quite using Windows. Not as simple a choice as it might be for a home user.
as a network administrator, I would be out of a job
Yeah
Wasn't it shown that
Unless they created a different, and better, solution for OS X, it seems likely this QuickTime vulnerability exists on that platform too.
give up computers.
I agree...
Quick Time Alternative
http://www.free-codecs.com/download/QuickTime_Alternative.htm
I believe it's a better player than the original. Just my opinion, though.
Interested Amateur
What? I'm left out again?
No you're not.
IE7 is not affected
Sounds simple, but...
[i]Another reason to upgrade to IE7[/i]
For many people this means buying a newer version of Windows, or a new computer, or both. Although it can be argued that this is a Good Thing, it remains enough of a challenge for many people that it's just not going to happen.
Pie Eaters
it has a flaw. Mostly, it's don't use .exe because
it's a Windows program or .app because it's an
Apple program. The computer groupies who never
conceived a line of code in their life have decided
what's good and what's bad. If you look a bit
deeper you'll see a lot of bad but it's in their
prefered system and can be overlooked and
remain unspoken. The concept of "Mine is better
than yours." actually means "My buying decision
and its consequences on my perceived
intelligence is better than yours." "I'm better than
you because I bought Windows, or Apple, or Linux
etc." Some groupies remind me of the sinking ship
wherein the would be survivor grabs an anchor
because he knows it's going over the side too but
beyond that thought, there's nothing.
RE: Unpatched QuickTime-to-Firefox flaw dings IE too
This so called Quicktime flaw has no affect at all on Linux. In fact I opened all of the test pages, that demonstrate how the vulnerability wors, with Firefox on my Linux box and nothing happened, the payload was not delivered.
This Quicktime flaw is very like the Skype flaw, which is used to infect Windows computers, with a worm, it requires the poor secueirity model upon which all Windows OSs are built, to work.