Another QuickTime RTSP flaw announced

There is a new exploit that affects how Apple QuickTime handles the Real Time Streaming Protocol (RTSP) and may allow an attacker to execute arbitrary code or cause a denial-of-service attack on a vulnerable system. The condition is similar yet different from a QuickTime RTSP flaw reported in December. This new vulnerability can occur on a fully patched QuickTime version 7.3.1, running on Windows and possibly Mac OS X.

Discovered by Luigi Auriemma, details can be found here, and here. Auriemma provides an exploit example on his site and writes: "For exploiting this vulnerability is only needed that an user follows a rtsp:// link, if the port 554 of the server is closed QuickTime will automatically change the transport and will try the HTTP protocol on port 80, the 404 error message of the server (other error numbers are valid too) will be visualized in the LCD-like screen."

Apple has not said when a patch for this will become available.

[mjm01010101]

Assume the protocol is flawed

There has been a vuln found in quicktime every month ever since release. Assume the protocol and player are therefore flawed.

[sjkx]

flawed assumption

Just because a protocol has security vulnerabilities doesn't imply
it's flawed, especially if it wasn't designed to be secure. Using your
"logic" many Internet protocols (including TCP and IP) are flawed.

[Ilgaz]

RTSP is the industry accepted standard (even for MS!)

The "Protocol" isn't flawed, its implementation (one of many!) has
issue. If Apple acts late again, whole web will be full of "uninstall
quicktime" advices which will hurt many things such as
mpeg4/h264 standard adoption.

[fred dunn]

Apple said "Sometime in Early 2008"....

What a real help. It appears they are more concerned with showing new products and Steve Job's ego than with security.