Apple on Wednesday released a new version of its QuickTime media player, patching a flaw in the application on both Windows and Mac OS X operating systems.
The technology giant fixed a bug in OS X versions 10.3.9, 10.4.9, 10.5 or later as well as Windows Vista and XP with Service Pack 2. The bug could allow application termination or arbitrary code execution.
The heap buffer overflow vulnerability exists in QuickTime's handling of HTTP responses when RTSP tunneling is enabled. The flaw, discovered last month by researcher Luigi Auriemma, can be exploited when an end-user visits a maliciously crafted webpage.
Secunia, a Copenhagen-based vulnerability monitoring organization, had ranked the flaw “highly critical,” meaning that it was a zero-day bug, but no exploit was seen in the wild.
FrSIRT, the French Security Incident Response Team, called the flaw “critical” in the sense that it can be exploited from a remote location.
US-CERT also warned users about the flaw last month, providing a number of workarounds while advising users to avoid links including URL encoding, IP address variations, long URLs and intentional misspellings.
Apple fixed four other bugs in the release of QuickTime 7.4 in the days following the HTTP bug's disclosure.
The technology giant fixed a bug in OS X versions 10.3.9, 10.4.9, 10.5 or later as well as Windows Vista and XP with Service Pack 2. The bug could allow application termination or arbitrary code execution.
The heap buffer overflow vulnerability exists in QuickTime's handling of HTTP responses when RTSP tunneling is enabled. The flaw, discovered last month by researcher Luigi Auriemma, can be exploited when an end-user visits a maliciously crafted webpage.
Secunia, a Copenhagen-based vulnerability monitoring organization, had ranked the flaw “highly critical,” meaning that it was a zero-day bug, but no exploit was seen in the wild.
FrSIRT, the French Security Incident Response Team, called the flaw “critical” in the sense that it can be exploited from a remote location.
US-CERT also warned users about the flaw last month, providing a number of workarounds while advising users to avoid links including URL encoding, IP address variations, long URLs and intentional misspellings.
Apple fixed four other bugs in the release of QuickTime 7.4 in the days following the HTTP bug's disclosure.
