Get Smart about Business Spending
QuickTime and iTunes DoS exploit released
A serious new flaw was disclosed on Thursday that affects the latest versions of Apple's QuickTime and iTunes applications.
The National Vulnerability Database entry CVE-2008-4116 describes a heap-based buffer overflow vulnerability within Apple's QuickTime 7.5.5 and iTunes 8.0 programs.
To infect a computer, a maliciously coded long-type attribute within a QuickTime tag might be placed on a Web page, or within a .mp4 or .mov file. This could allow remote attackers to crash the applications (known as a denial of service) or possibly execute arbitrary code on a compromised computer.
The announcement comes one week after
At the moment, there is no recommended workaround or patch available for the code exploit.
Apple did not reply to a request for comment.
As CNET's resident security expert, Robert Vamosi has been interviewed on the BBC, CNN, MSNBC, and other outlets to share his knowledge about the latest online threats and to offer advice on personal and corporate security. Listen to his podcast at securitybites.cnet.com or e-mail Robert with your questions and comments. 
It just means that you have to be careful when you are surfing porn on the internet... just like always.
From the article posted above...
"To infect a computer, a maliciously coded long-type attribute within a QuickTime tag might be placed on a Web page, or within a .mp4 or .mov file. This could allow remote attackers to crash the applications (known as a denial of service) or possibly execute arbitrary code on a compromised computer."
I've said my piece....feel free to light that flamethrower again.
An unusually long data, in the attribute of a quicktime tag, can cause QuickTime to not work. This means any programs trying to use Quicktime will not render the file, and will possibly terminate. To my knowledge, this just means that particular file cannot be played.
This isn't a denial of service. Suddenly we are getting real loose about what things mean. Denial of service means you will not be able to use Quicktime at all if "infected", and by the way, this isn't an infection either. I'm starting to get a little pissed about the loose terms being flippantly tossed around.
This is a bug in the log of Quicktime that terminates on this tag. End of story.
http://en.wikipedia.org/wiki/Denial-of-service_attack
Nevertheless, the "possibly [to] execute arbitrary code on a compromised computer" is a serious matter. It's bug with serious ramification
My comment pretains to all the virus, hacker, phishing and any other illlegal computer activity. As a society of law and order we must take action against the computer criminals with through investigations, harsh punishment, extreamly harsh! If a few individuals were made an example out of, this illeagle activity would be greatly reduced. For example, the individual who broke into Sarah Palin's email accout should be sentenced to no less than 2 years of picking up trash along an interstate highway 16 hours a day 7 days a week. That would give that 18 year old collage student some much needed time to learn to think a little more clearly. Thank you all stay safe in the virtual world.
SANS, until it is a "run remote code" Please don't be alarmist and throw a CRITICAL label against a hack that will simply crash the application.
If all the QuickTime programmers were lined up and every third one was fired, it would send the right message.
- by maneeshpan1 September 19, 2008 8:54 PM PDT
- Do these flaws affect QuickTime and iTunes only on Windows? Or are Mac users with the latest versions of QuickTime (QuickTime 7.5.5) and iTunes 8.0 also affected?
- Like this Reply to this comment
-
(20 Comments)Regardless, hopefully Apple will issue a patch to fix these problems soon.