Apple posts QuickTime 7.3.1 security update
Apple on Thursday night issued a hotfix for its QuickTime media player that patches a single but already exploited flaw in the software's handling of streaming content.
The exploit sends an improper header through QuickTime's Real Time Streaming Protocol (RTSP) service, triggering a buffer overflow that permits a hacker to run their own code and compromise an affected system.
In recent days, a website known as Ourvoyeur.net has reportedly been hijacked and used to infect systems with malware that opens a back door for hackers. That exploit targets Windows users but could theoretically apply to Mac OS X as well given the existence of the flaw in Apple's own operating system, according to one report.
The QuickTime patch is available both for the critically affected Windows systems in a 20MB download but is also offered as a roughly 50MB fix for Mac OS X Panther, Tiger, and Leopard.
The exploit sends an improper header through QuickTime's Real Time Streaming Protocol (RTSP) service, triggering a buffer overflow that permits a hacker to run their own code and compromise an affected system.
In recent days, a website known as Ourvoyeur.net has reportedly been hijacked and used to infect systems with malware that opens a back door for hackers. That exploit targets Windows users but could theoretically apply to Mac OS X as well given the existence of the flaw in Apple's own operating system, according to one report.
The QuickTime patch is available both for the critically affected Windows systems in a 20MB download but is also offered as a roughly 50MB fix for Mac OS X Panther, Tiger, and Leopard.
Comments
Is there any way to remove this plugin from a Mac without breaking Safari?
Remove the quicktime components from /Library/Internet plug-ins.
I like that there's a link to a voyeur site in the article.
Remove the quicktime components from /Library/Internet plug-ins.
I like that there's a link to a voyeur site in the article.
Unless something changed, they said the name of the site, but there is no web link.
Unless something changed, they said the name of the site, but there is no web link.
Though there is no clickable web link, there is the complete URL of the site. Just out of curiosity, and after having applied the update, I entered the URL into Firefox to see what it gives. So, it is a nudity site and Firefox suddenly started hitting hard the hard disk and the UI almost froze up. I tried to kill it and it worked after several seconds of hard disk grinding.
Though there is no clickable web link, there is the complete URL of the site.
That's pretty much what I said, but worded differently.
So, I was in a hurry and I did not finish my previous message: after my experience with the afore mentioned site, I think Kasper should edit the original article and remove the URL. Or provide just the site name without the extension. Or something anyway. No joking.
It's not a complete URL, it's just the domain name. In order to even go there you still have to manually enter it.
...could theoretically apply to Mac OS X as well...
Could theoretically apply.
I can't wait to see ZDnet spin this as another "oh noes!" story. This is an example of great proactive work by Apple. They consistently fix potential problems while they ARE simply potential.
It's not a complete URL, it's just the domain name. In order to even go there you still have to manually enter it.
Yes, you can manually enter it since you know it. It is a site with explicit nudity and reportedly a platform for attacks. It should go away. Just my opinion.
Yes, you can manually enter it since you know it. It is a site with explicit nudity and reportedly a platform for attacks. It should go away. Just my opinion.
I just thought I could give it a try (just out of curiosity). Bad idea. Safari just gone nuts.
After the patch i should mention.
"Do not look into laser with remaining eye"
LOL, good one.
I'm patched, but is there a way to know if you've been "backdoored"?
All of the exploits for this flaw were for Windows only. There are no reports of Mac users being 'backdoored'? Feel better now?
Though there is no clickable web link, there is the complete URL of the site. Just out of curiosity, and after having applied the update, I entered the URL into Firefox to see what it gives. So, it is a nudity site and Firefox suddenly started hitting hard the hard disk and the UI almost froze up. I tried to kill it and it worked after several seconds of hard disk grinding.
Same thing here. Although you have to copy/paste the link, I was curious as to what was on it and bam within a few seconds, everything just freezes up gradually. Fortunately I was able to force quit Safari but I think there should at least be a warning about what visiting the site will do in the article.
I don't even think that's the effect the article is about because the exploit only targets windows so something else is screwed up on that site.
Same thing here. Although you have to copy/paste the link, I was curious as to what was on it and bam within a few seconds, everything just freezes up gradually. Fortunately I was able to force quit Safari but I think there should at least be a warning about what visiting the site will do in the article.
What do you need to call it a warning, blinky lights? A yellow triangle?
In the same sentence, right after the site name: "has reportedly been hijacked and used to infect systems with malware that opens a back door for hackers". I'd think that should be more than a hint to not tempt fate.
"Do not look into laser with remaining eye"
I know a laser lab that has that posted on the wall.
Though there is no clickable web link, there is the complete URL of the site. Just out of curiosity, and after having applied the update, I entered the URL into Firefox to see what it gives. So, it is a nudity site and Firefox suddenly started hitting hard the hard disk and the UI almost froze up. I tried to kill it and it worked after several seconds of hard disk grinding.
Someone once said, "Curiosity killed the cat."