Apple has issued a security patch for its QuickTime application nearly 11 days after the disclosure of a highly-publicised vulnerability.
The vulnerability occurs in the way QuickTime handles JavaScript code. An attacker could use a specially-crafted Java applet embedded in a web page to execute code on a machine with the permissions of the current user.
The vulnerability was discovered by independent security researcher Dino Dai Zovi, who developed a working exploit in a matter of hours.
Dai Zovi and partner Shane Macauley used the exploit to win a MacBook Pro and $10,000 prize at the CanSecWest security conference.
The vulnerability was originally reported to exist only in Safari. However, Dai Zovi and Tipping Point later disclosed that the vulnerability affected all Mac and PC Java-enabled browsers on systems with QuickTime installed.
View: Vnunet.com
The vulnerability occurs in the way QuickTime handles JavaScript code. An attacker could use a specially-crafted Java applet embedded in a web page to execute code on a machine with the permissions of the current user.
The vulnerability was discovered by independent security researcher Dino Dai Zovi, who developed a working exploit in a matter of hours.
Dai Zovi and partner Shane Macauley used the exploit to win a MacBook Pro and $10,000 prize at the CanSecWest security conference.
The vulnerability was originally reported to exist only in Safari. However, Dai Zovi and Tipping Point later disclosed that the vulnerability affected all Mac and PC Java-enabled browsers on systems with QuickTime installed.
View: Vnunet.com
Windows Installer Error 2738
I only figured it out today.
Wow, that was a fast patch release.
A clean install of Windows XP (SP1a or newer) doesn't include Java. No Java, no exploit.
Vista doesn't include Java either, and on top of that, it runs IE7 in Protected Mode, which is sandboxed and prevents anything running inside IE from changing anything on your system. So even if Quicktime gets exploited, it can't damage any of your files.
Last edited by aaaaa0 on 03 May 2007 - 09:29
Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!
Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.