Severity: High
10 June, 2008
Summary:
- This vulnerability affects: Quicktime 7.4.5 for Mac and PC (and possibly earlier versions)
- How an attacker exploits it: By enticing your users to download and play a malicious multimedia file in Quicktime
- Impact: Attacker executes code on your user’s computer, potentially gaining complete control of it
- What to do: If you allow Quicktime (or iTunes), upgrade to version 7.5; otherwise, remove these applications from your company’s computers
Exposure:
Today, Apple released an alert fixing five vulnerabilities in its popular media player application, Quicktime. (Current versions of iTunes ship with the program as well; if your users have iTunes, they most likely have Quicktime.) These applications run on Windows and Macintosh computers, and both platforms are susceptible to exploitation of these security flaws. Apple’s alert specifies Vista and XP SP2 as the vulnerable versions of Windows.
The vulnerabilities relate to different processes in Quicktime (for example, how it opens picture files, how it displays movie files, how it handles audio files, and so on); but the flaws share a similar result if successfully exploited. If an attacker can get one of your users to open a specially crafted multimedia file, or to click a URL that links to malicious QuickTime content, he could trigger any of these flaws to execute code on your user’s computer, with the same privileges and permissions your user has. If your users have local administrative privileges, the attacker could gain complete control of their machines.
The primary difference between these flaws involves which multimedia file the attacker can use to exploit them. The potentially dangerous files that could trigger these flaws are:
- PICT images (.pict)
- AAC audio files (.aac)
- Indeo video files (.mov, .avi, etc…)
Severity: High
10 June, 2008
Summary:
- This vulnerability affects: Quicktime 7.4.5 for Mac and PC (and possibly earlier versions)
- How an attacker exploits it: By enticing your users to download and play a malicious multimedia file in Quicktime
- Impact: Attacker executes code on your user’s computer, potentially gaining complete control of it
- What to do: If you allow Quicktime (or iTunes), upgrade to version 7.5; otherwise, remove these applications from your company’s computers
Exposure:
Today, Apple released an alert fixing five vulnerabilities in its popular media player application, Quicktime. (Current versions of iTunes ship with the program as well; if your users have iTunes, they most likely have Quicktime.) These applications run on Windows and Macintosh computers, and both platforms are susceptible to exploitation of these security flaws. Apple’s alert specifies Vista and XP SP2 as the vulnerable versions of Windows.
The vulnerabilities relate to different processes in Quicktime (for example, how it opens picture files, how it displays movie files, how it handles audio files, and so on); but the flaws share a similar result if successfully exploited. If an attacker can get one of your users to open a specially crafted multimedia file, or to click a URL that links to malicious QuickTime content, he could trigger any of these flaws to execute code on your user’s computer, with the same privileges and permissions your user has. If your users have local administrative privileges, the attacker could gain complete control of their machines.
The primary difference between these flaws involves which multimedia file the attacker can use to exploit them. The potentially dangerous files that could trigger these flaws are:
- PICT images (.pict)
- AAC audio files (.aac)
- Indeo video files (.mov, .avi, etc…)
Solution Path:
Apple has released Quicktime version 7.5 to correct these flaws. If you allow (or suspect that your users have installed) Quicktime or iTunes in your network, we recommend that you have your users either remove the applications or install version 7.5.
The latest versions of Quicktime and iTunes for Windows ship with Apple Software Update. Apple Software Update automatically detects updates such as this one for Quicktime and then informs you, so that you can install it as soon as possible. If you choose to allow Quicktime or iTunes in your network, we recommend you set Apple Software Update to check for new updates daily and allow it to assist you in keeping your Apple software current.
Note: By default, Apple ships Quicktime combined with iTunes. If you do not want iTunes, download the standalone version of Quicktime.
For All Users:
These attacks rely on one of your users downloading and opening any of several different Quicktime movie, image, or audio file types. Many of these multimedia formats have legitimate business uses and should not be blocked in their entirety at your firewall. Unless you want to block all the media types that Quicktime supports, you should insist that users either remove Quicktime and iTunes, or install Apple’s Quicktime update as soon as possible.
Status:
Apple released Quicktime 7.5, which fixes this issue.