Original URL: http://www.channelregister.co.uk/2007/04/25/quicktime_vuln_fells_mac/
Updated The zero-day vulnerability that allowed a hacker to commandeer a brand new MacBook Pro late last week resides in a flaw in Apple's QuickTime media player, the exploit's author says. The revelation corrects descriptions given last Friday (http://www.theregister.com/2007/04/20/pwn-2-own_winner/) that the exploit targeted Safari.
Dino Dai Zovi set the record straight in a blog posting (http://www.matasano.com/log/812/breaking-macbook-vuln-in-quicktime-affects-win32-apple-code/) yesterday. It adds that Mac users browsing with Firefox are also vulnerable if QuickTime is installed and that QuickTime may put Java-enabled browsers on Windows machines at risk as well. Several hours after this story was first published, a new entry (http://www.matasano.com/log/839/the-bug-report-that-would-not-die-dinos-finding-works-in-ie7/) appeared that said unnamed sources at 3com have determined the QuickTime flaw is also exploitable on Internet Explorer versions 6 and 7.
Secunia has rated the QuickTime flaw highly critical (http://secunia.com/advisories/25011/), its second highest rating. "This can be exploited to execute arbitrary code when a user visits a malicious web site," the site warned. It recommends users disable Java as a work around until Apple releases a patch.
On Friday, Shane Macaulay, a friend of Dai Zovi's who participated in a "pwn-2-own" contest at the CanSecWest conference in Vancouver, described the flaw as residing in Safari. Dai Zovi, who wrote the exploit but didn't actually attend the conference, said on Tuesday that the vulnerability in fact lies in the way QuickTime handles Java. The exploit required a machine visit a booby-trapped website in order to work. Dai Zovi spent about nine hours writing the exploit, which allows a hacker to remotely gain full user rights to the targeted machine.
Under the contest rules, a successful exploit entitled the author to go home with the hacked machine. It also nets him a $10,000 bounty from security provider Tipping Point pending confirmation of the finding.
Dai Zovi on Tuesday declined to discuss the QuickTime in detail other than to say it allows a client-side Java error to execute arbitrary code when a Java-enabled browser visits a malicious website.
Dai Zovi's handiwork is only the latest discovery of a QuickTime vulnerability. Last month, Apple issued an update that plugged eight holes in the popular media playback software. ®
eBay pulls Vista laptop pwned in hacking contest (2 April 2008)
http://www.channelregister.co.uk/2008/04/02/ebay_pulls_hacked_laptop/
Only Ubuntu left standing, as Flash vuln fells Vista in Pwn2Own hacking contest (29 March 2008)
http://www.channelregister.co.uk/2008/03/29/ubuntu_left_standing/
Mac is the first to fall in Pwn2Own hack contest (28 March 2008)
http://www.channelregister.co.uk/2008/03/28/mac_hack/
So what's the easiest box to hack - Vista, Ubuntu or OS X? (19 March 2008)
http://www.channelregister.co.uk/2008/03/19/pwn2own_contest_returns/
QuickTime update fixes code-execution holes (6 November 2007)
http://www.channelregister.co.uk/2007/11/06/new_quicktime_update/
Apple patches Windows QuickTime bug (4 October 2007)
http://www.channelregister.co.uk/2007/10/04/windows_quicktime_update/
Security maven: QuickTime flaw threatens PCs, Macs (12 September 2007)
http://www.theregister.co.uk/2007/09/12/quicktime_vulnerability_attacks_firefox/
Linkedin spurns bug bounty hunter (31 July 2007)
http://www.channelregister.co.uk/2007/07/31/fees_for_exploits/
Apple TV gets its first critical security patch (20 June 2007)
http://www.theregister.co.uk/2007/06/20/critical_appletv_patch/
Apple plugs holes in new Safari beta (14 June 2007)
http://www.channelregister.co.uk/2007/06/14/safari_holes_plugged/
Apple's Safari lacks bold vision (13 June 2007)
http://www.channelregister.co.uk/2007/06/13/safari_cant_see_bold/
Security researchers poke holes in Safari (12 June 2007)
http://www.channelregister.co.uk/2007/06/12/safari_security_bugs/
Apple's Safari 3: a crashing experience for non-US users (12 June 2007)
http://www.channelregister.co.uk/2007/06/12/safar_crashing_experience/
Jobs: one more thing... a browser war (12 June 2007)
http://www.channelregister.co.uk/2007/06/12/apple_browser_war_safari_firefox/
Apple patches more than a dozen holes in OS X (25 May 2007)
http://www.channelregister.co.uk/2007/05/25/osx_security_update/
Seven flaws lanced in MS patch batch (9 May 2007)
http://www.channelregister.co.uk/2007/05/09/ms_may_patch_tuesday/
Poisoned MP4 files threaten Winamp users (2 May 2007)
http://www.channelregister.co.uk/2007/05/02/winamp_0-day/
Anti-Apple lawsuit cites 20-year-old patent (25 April 2007)
http://www.reghardware.co.uk/2007/04/25/apple_sued_over_common_ui_element/
A Mac gets whacked, a second survives (23 April 2007)
http://www.theregister.co.uk/2007/04/23/mac_vuln_contest/
Safari zero-day exploit nets $10,000 prize (20 April 2007)
http://www.channelregister.co.uk/2007/04/20/pwn-2-own_winner/
MySpace-hosted malware exploits QuickTime flaw (16 March 2007)
http://www.theregister.co.uk/2007/03/16/myspace_quicktime_exploit/
Apple patches QuickTime bug (24 January 2007)
http://www.channelregister.co.uk/2007/01/24/apple_patches_quicktime_bug/
Unpatched bug bites QuickTime (3 January 2007)
http://www.channelregister.co.uk/2007/01/03/quicktime_vuln/
Phishing worm hooks MySpace users (5 December 2006)
http://www.channelregister.co.uk/2006/12/05/myspace_phishing_worm/
Unpatched bug bites Apple Mac OS X (22 November 2006)
http://www.channelregister.co.uk/2006/11/22/mac_zero_day_bug/
Malware goes to the movies (16 November 2006)
http://www.channelregister.co.uk/2006/11/16/movies_gets_malware/
Hackers target home users for cash (25 September 2006)
http://www.channelregister.co.uk/2006/09/25/symantec_threat_report/
Security bugs take a bite out of Apple (7 December 2004)
http://www.theregister.co.uk/2004/12/07/apple_vuln/
© Copyright 2008