Free Newsletters
Technology & Business Daily

InfoWorld
Log-in | Register

Apple fixes critical QuickTime bug

The flaw in QuickTime's Real Time Streaming Protocol had been worrying security researchers for close to a month


Apple has released a security fix for its QuickTime media player software, fixing a critical bug that had been worrying security experts for nearly a month.

The update, released Wednesday, fixes a vulnerability in the RTSP (Real Time Streaming Protocol) used by QuickTime to handle streaming media. It also fixes a previously reported incompatibility between QuickTime 7.4 and Adobe Premiere and After Effects, according to an Apple spokesman.

On Jan. 10, researcher Luigi Auriemma disclosed the flaw by posting proof-of-concept attack code that could be used to run unauthorized software on a victim's computer. For the attack to work, the criminal would have to first trick the user into viewing a maliciously encoded QuickTime media file.

With the attack code available, security researchers had been hoping that Apple would address the flaw. Wednesday's QuickTime 7.4.1 update is for both the Mac OS X and Windows operating systems.

It is Apple's fifth QuickTime update since October. The company has been forced to issue the flurry of patches as security researchers have taken a closer look at media player flaws during the past year. In December, Apple patched a separate RTSP vulnerability, which online criminals had already started to use in their attacks.

"In the past few months, QuickTime has been a prevalent target for security researchers," said Andrew Storms, director of security operations with nCircle Network Security. "Internet media applications on the desktop have been a rich target for attackers, and this trend is sure to continue as most users aren't yet accustomed to attacks arriving in the form of a viral video."


Talkback:

commentPost a Comment

 

MOST COMMENTS

 
 





Application Grid: Oracle's Vision for Next-Generation Application Servers and Infrastructure
View this live Webcast to hear senior Oracle executives Hasan Rizvi and Steve Harris discuss the application grid. Learn how Oracle is combining cutting-edge technologies from its recent acquisition of BEA with the Fusion Middleware portfolio. Discover a new level of reliability, performance, and "scale-agility" in your data center, with emphasis on efficiency for today's challenging economic environment. Sponsored by Oracle

»  Click here to view this Webcast
  The Path to Enterprise Security
This is your comprehensive guide to Enterprise Security. In it you'll find solutions to the most pressing security threats facing you and your company. Learn the latest on insider threats and how to effectively minimize risk within your organization. Sponsored by Nokia

»  Click here to download now

- Special Advertising Partners -
WHITE PAPERS
 

» Technology White Papers Library

Technology White Papers by Topic

Technology White Papers E-mail Alert

Find out when the latest white paper is available:
 
 
INFOWORLD MARKETPLACE
 
» BUY A LINK NOW
 
 

Video

 
 
 

Podcasts

 
IFW Daily 09/05/2008

Sun to craft software stack into NAS appliances, former CA CEO Sanjay...

 
 

 

Columnists

 
 
 

Resource Center


Ads by techwords beta  [See your link here]
 




Sponsored Technology Links

 
 
 HOME  NEWS  BLOGS  PODCASTS  VIDEOS  TECHNOLOGIES  TEST CENTER  EVENTS  CAREERS   About | Advertise | Awards | RSS | Contact Us 

Copyright © 2008, Reprints, Permissions, Licensing, IDG Network, Privacy Policy, Terms of Service.
All Rights reserved. InfoWorld is a leading publisher of technology information and product reviews on topics including viruses,
phishing, worms, firewalls, security, servers, storage, networking, wireless, databases, and web services.

CIO :: ComputerWorld :: CSO :: Demo :: GamePro :: Games.net :: IDG Connect :: IDG World Expo
Industry Standard :: IT World :: JavaWorld :: LinuxWorld :: MacUser :: Macworld :: Network World :: PC World :: Playlist