National Vulnerability Database posts - Security

September 18, 2008 11:22 AM PDT

A serious new flaw was disclosed on Thursday that affects the latest versions of Apple's QuickTime and iTunes applications.

The National Vulnerability Database entry CVE-2008-4116 describes a heap-based buffer overflow vulnerability within Apple's QuickTime 7.5.5 and iTunes 8.0 programs.

To infect a computer, a maliciously coded long-type attribute within a QuickTime tag might be placed on a Web page, or within a .mp4 or .mov file. This could allow remote attackers to crash the applications (known as a denial of service) or possibly execute arbitrary code on a compromised computer.

The announcement comes one week after Apple patched nine security flaws in its media player and fixed Windows Vista problems within its recently updated online music service.

At the moment, there is no recommended workaround or patch available for the code exploit.

Apple did not reply to a request for comment.

Topics:: Vulnerabilities and attacks,; News

Tags:: security,; Apple,; National Vulnerability Database,; buffer overflow,; QuickTime,; iTunes

Share:: Digg; Del.icio.us; Reddit; Facebook; Twitter

About Security

Online security is threatened by more than hacking and phishing attempts. Check here for the latest updates on software vulnerabilities, data leaks, and rapidly spreading viruses--and learn how to protect your systems.

Add this feed to your online news reader

Security topics

Inside CNET News

Scroll Left Scroll Right

Business Tech
Kindle is most gifted Amazon item, ever
Statement on holiday sales declares the Kindle king; On Christmas Day, for the first time ever, more books for the e-reader sold than physical copies.
Gallery
Top-rated reviews of the week (photos)
The Open Road
Open source became big business in 2009
Open source has always been an important sideshow for software vendors, but in 2009 it became the main event thanks to Google.
Beyond Binary
Visual Studio launch delayed by 'a few weeks'
Microsoft says it's still working to resolve some performance issues related to the Visual Studio 2010 developer tool suite, which was slated for a March release.
Video
Behind the scenes of CBS's NFL coverage
Technically Incorrect
Police to put drunk drivers' names on Twitter
Montgomery County, Texas, decides that the best way to deter those who want to drink and drive over the festive period is to out them on the microblog.
Video
Deep-sea volcanic explosion--part 2 (video)
The Social
Facebook COO nominated to Disney board
Sheryl Sandberg, who has been chief operating officer of the social network for nearly two years now, will join the board if shareholders approve in March.
The Space Shot
Soyuz craft docks, boosts space station crew
A Russian Soyuz spacecraft docked with the International Space Station Tuesday after a smooth, automated approach, boosting the lab's crew back up to five.
Gallery
Lookout keeps an eye on mobile-device security (photos)
Crave
New, terrifying, no-electronics U.S. flight security rules?
The TSA hasn't made an official ruling, but it appears the failed terrorist attack Friday is leading to restrictions on in-flight electronics on a case-by-case basis.
Green Tech
Ford sees bump in hybrid sales
Carmaker says its hybrid sales are up 67 percent this year, despite an 11 percent slump industrywide.