QTL vulnerability clould allow attackers to run malicious code
vnunet.com, 02 Jan 2007
Apple's QuickTime software has been hit by a buffer overflow bug that could allow malicious code to be run on Windows and Mac PCs.
The vulnerability uses a specially crafted QTL file to cause a stack-based buffer overflow that allows the execution of arbitrary code.
The problem occurs when an 'src' parameter is created with more than 256 bytes.
"After successful exploitation, control over EIP is gained. This is a simple good-old stack smashing," said the first report of the problem at the Month of Apple Bugs website.
The vulnerability has been successfully exploited in QuickTime version 7.1.3, although previous versions are also expected to be vulnerable.
Security website Secunia warned that the only way for users to protect themselves against the attack is not to open untrusted QTL files.
12.99 MBComputing podcast - IT implications of the banking crisis, and the FSA clamps down on IT security More...
Web application tool revamp promised later today More...
Events such as Microsoft's Patch Tuesday could be used for... More...
MoD admits to losing a hard drive containing up to... More...
Do you agree?
Have your say on this article