Apple Secures QuickTime

QuickTime users can breathe a collective sigh of relief. After weeks of
being at risk from an unpatched security vulnerability, Apple yesterday addressed the hole in its media-playing software.

Among the trio of vulnerabilities fixed in the QuickTime 7.3.1 release is a flaw first publicly reported nearly a month ago, involving Real Time Streaming Protocol (RTSP) headers. The severity of the problem triggered a
US-CERT Technical Cyber Security Alert two weeks ago.

Apple’s QuickTime 7.3.1 security advisory noted that the newest update fixes
the RTSP issue by “ensuring that the destination buffer is sized to contain the data.” The RTSP flaw could have allowed an attacker to trigger a buffer overflow that could lead to a system crash or arbitrary code execution.

The second flaw fixed by Apple in the QuickTime 7.3.1 update also related to a buffer overflow. In this case, the flaw resided in how QuickTime handled QTL (QuickTime Link) files. Apple claims to have fixed the issue with improved checking of the file.

The last flaw addressed by the QuickTime update deals with how QuickTime handles Adobe’s Flash media. Apple’s advisory noted that there are multiple vulnerabilities in QuickTime’s Flash media handler.

However, the fix for this issue doesn’t involve Apple actually addressing the reasons why the Flash handler is insecure. Instead, to eliminate the threat, Apple disabled the Flash media handler in QuickTime entirely.

The QuickTime 7.3.1 update marks the third update for the media-playing software from Apple in three months. Both the 7.2 and the 7.3 releases dealt with media-handling issues as well.

QuickTime 7.3.1 is available as a free download from the Apple Downloads site.