Apple Fixes Code Holes in QuickTime

Wednesday, March 5, 2014 @ 11:03 AM gHale


Apple patched vulnerabilities in the Windows version of its QuickTime media player that allowed malicious video files to execute arbitrary code.

Apple said version 7.7.5 of QuickTime will fix 10 serious vulnerabilities that can end up exploited to crash the software or pull off remote-code execution on Windows 7, Vista and XP PCs. Researchers at Microsoft, iDefense VCP, Tencent Security Team and others through HP’s Zero Day Initiative found the holes.

RELATED STORIES
Apple Patches SSL Bug in OS X
iOS 7 Patched, Other Devices at Risk
Apps Lack of Security
Apple iOS Hijacking Bug

Apple said the vulnerabilities include:
• An uninitialized pointer issue existed in the handling of track lists.
• A buffer overflow existed in the handling of H.264 encoded movie files.
• An out of bounds byte swapping issue existed in the handling of QuickTime image descriptions.
• A signedness issue existed in the handling of ‘stsz’ atoms.
• A buffer overflow existed in the handling of ‘ftab’ atoms.
• A memory corruption issue existed in the handling of ‘dref’ atoms.
• A buffer overflow existed in the handling of ‘ldat’ atoms.
• A buffer overflow existed in the handling of PSD images.
• An out of bounds byte swapping issue existed in the handling of ‘ttfo’ elements.
• A buffer overflow existed in the handling of ‘clef’ atoms.

Malware could end up on a vulnerable machine if the user visits a drive-by-download website that hosts a specially crafted movie; the QT player would open the file, triggering a bug and executing code to install malicious software.

Users can get the updates through the Apple Software Update tool or from the company’s security downloads page. Apple did not report any attacks targeting the flaws.



Leave a Reply

You must be logged in to post a comment.