Running QuickTime may well involve more risk to users than just the risk of
seeing bad video content. Apple has pushed out a security update for its
QuickTime software, the second security update to the media playing software
in just over a month.
QuickTime version 7.3 fixes at least 7 security issues that could have left
users PC or Macs at the mercy of hackers.
Two of the fixes deal with separate flaws related to how QuickTime provides
descriptions for images. CVE-2007-2395 describes a flaw whereby if a user
simply viewed a QuickTime file with a corrupt image description it could
trigger arbitrary code execution. Apple has now added new file validation
checks to ensure that won’t happen anymore. In another fix related to
descriptions, the issue that Apple identified was a heap buffer overflow
condition that also could have allowed for arbitrary code execution.
Java usage also presented a problem for QuickTime.
CVE-2007-3751 describes what the Apple advisory identifies as multiple
vulnerabilities,” which may allow untrusted Java applets to obtain elevated
privileges.” The fix? Apple has now ensured that untrusted Java applets
can’t access QuickTime.
While QuickTime is often though of as just a video media player it can show
still images as well, the QuickTime 7.3 release fixes two issues related to
that use case. The two flaws have to deal with how QuickTime processes PICT
images. If a user views a maliciously crafted file it could have led to
either a stack buffer overflow or a crash, in either case arbitrary code
execution could have been the ultimate result. The Apple fix for the issue
is to provide additional validation of PICT files.
QuickTime 7.3 is being released just barely a month after the 7.2 release
came out. The 7.2 release dealt with a number of long standing URL
handling issues that Apple had attempted to fix for the better part of 2007.
