The Channel logo

News

By | Dan Goodin 30th May 2007 01:09

Apple plugs two QuickTime holes

Second security patch in less than a week

Apple has plugged two holes in its QuickTime media player that could create serious security problems for people tricked into visiting malicious websites. The release, which is available for both Windows and Mac platforms, is Apple's second security patch in less than a week.

The most serious of the two vulnerabilities involves QuickTime's implementation of Java, which could allow for the manipulation of objects outside what should be allowed by the allocated heap.

"By enticing a user to visit a web page containing a maliciously crafted Java applet, an attacker can trigger the issue which may lead to arbitrary code execution," Apple said in this advisory.

Apple gave credit to John McDonald, Paul Griswold, and Tom Cross of IBM Internet Security Systems X-Force and Dyon Balding of Secunia Research for reporting the flaw.

The other vulnerability also resides in the way QuickTime works with Java and could allow a maliciously crafted applet to read a web browser's memory. That could allow an attacker access to potentially sensitive information, Apple said.

If it seems like Apple security team has been working overtime, it's because it has. On Thursday, the maker of the increasingly popular iMac and iBook released its fifth mega patch in as many months. This fixed more than a dozen security vulnerabilities in OS X. Less than three weeks earlier, Apple patched another hole in QuickTime that could also allow a booby-trapped website to execute malicious code on unwitting Mac users.

QuickTime has emerged as one of the more vulnerable Apple packages, with at least four security updates this year. QuickTime's susceptibility is due in part to its ability to run on both Windows and OS X and its wide use (and occasional abuse) on sites such MySpace.

Apple's update is here. ®

comment icon Read 1 comment on this article alert Send corrections

Opinion

Baby looks taken aback/shocked/affronted. Photo by Shutterstock

Kat Hall

Plans for 2 million FTTP connections in next four years 'not enough'
Microsoft CEO Satya Nadella
Stranded_ships

Chris Mellor

Thousands of layoffs announced as spinning rust enters its death spiral

Features

STRASBOURG, JUNE 29, 2016: The seat of the European Parliament. by Marco Aprile for shutterstock. EDITORIAL USE ONLY
Plan b, image via Shutterstock
EU workers, new markets: post-Brexit pressure on May & Co
Tough question, pic via Shutterstock
Honest mistake with your licensing? Audit police look at it on a 'case by case basis'