Apple Ends QuickTime for Windows Support

Monday, April 18, 2016 @ 03:04 PM gHale


Apple will no longer issue security updates for the Windows version of QuickTime.

That is all well and good, but the move will now leave unpatched two remote code execution vulnerabilities.

RELATED STORIES
Patching Tool Under Scrutiny
Corporate iOS Devices Targeted
iOS Zero Day in iMessage Encryption
New Way to Hack iCloud Account

Apple did not reveal the QuickTime for Windows news. ZDI, from Trend Micro, learned of Apple’s decision after Steven Seeley of Source Incite reported finding two serious flaws.

The issues found by Seeley are heap corruption vulnerabilities where an attacker could exploit for remote code execution if they can convince the targeted user to access a maliciously crafted website or file.

“One vulnerability occurs where an attacker can write data outside of an allocated heap buffer. The other vulnerability occurs in the stco atom where by providing an invalid index, an attacker can write data outside of an allocated heap buffer,” Trend Micro said in a blog post.

The flaws ended up reported to Apple November 11, and the vendor informed ZDI March 9 it is ending support for QuickTime on Windows.

Apple published instructions on how to remove QuickTime for Windows. The company told users websites increasingly use HTML5 for video playback and advised them to remove legacy plugins to enhance the security of their PC.

The QuickTime plugin has been disabled in OS X and web browsers, which should prevent attackers from exploiting the vulnerabilities found by Seeley via a malicious website.

US-CERT has also published an advisory on the matter, informing users that remote attackers could take control of their systems by exploiting vulnerabilities in QuickTime for Windows.