Apple Secures QuickTime
Third update in as many months fixes a pair of media flaws and disables another.
QuickTime users can breathe a collective sigh of relief. After weeks of being at risk from an unpatched security vulnerability, Apple yesterday addressed the hole in its media-playing software.
Among the trio of vulnerabilities fixed in the QuickTime 7.3.1 release is a flaw first publicly reported nearly a month ago, involving Real Time Streaming Protocol (RTSP) headers. The severity of the problem triggered a US-CERT Technical Cyber Security Alert two weeks ago.
Apple's QuickTime 7.3.1 security advisory noted that the newest update fixes the RTSP issue by "ensuring that the destination buffer is sized to contain the data." The RTSP flaw could have allowed an attacker to trigger a buffer overflow that could lead to a system crash or arbitrary code execution.
The last flaw addressed by the QuickTime update deals with how QuickTime handles Adobe's Flash media. Apple's advisory noted that there are multiple vulnerabilities in QuickTime's Flash media handler.
However, the fix for this issue doesn't involve Apple actually addressing the reasons why the Flash handler is insecure. Instead, to eliminate the threat, Apple disabled the Flash media handler in QuickTime entirely.