Sysadmin News

Description:
h07 has discovered a vulnerability in Apple QuickTime, which can be exploited by malicious people to compromise a user’s system.

The vulnerability is caused due to a boundary error when processing RTSP replies and can be exploited to cause a stack-based buffer overflow via a specially crafted RTSP reply containing an overly long “Content-Type” header.

Successful exploitation allows execution of arbitrary code and requires that the user is e.g. tricked into opening a malicious QTL file or visiting a malicious web site.

The vulnerability is confirmed in version 7.3. Other versions may also be affected.

NOTE: A working exploit is publicly available.

Solution:
Do not browse untrusted websites, follow untrusted links, nor open untrusted QTL files.

Provided and/or discovered by:
h07

Original Advisory:
http://www.milw0rm.com/exploits/4648