RSSApple Plugs QuickTime Security Holes
By the Betanews Staff | Published March 5, 2007, 7:50 PM
Apple on Monday put out new releases of iTunes and QuickTime for both Mac OS X and Windows, adding support for the company's Apple TV product in the former and patching 8 serious security holes in the latter.
Each of the flaws could enable an attacker to create a malicious QuickTime file that, when run, executes arbitrary code and could lead to a full system compromise. Affected file types that have been corrected include QuickTime, MIDI, 3GP, PICT and QTIF files. iTunes 7.1 and QuickTime 7.1.5 are available for download on FileForum.
This is old news...the patches have been out for a while. Quicktime is a very versatile program that supports many formats. Its bound to need updates, duh. And its not BetaNews its OldBetaUpdates.
Please report on REAL news!
Score: 0
|yeah. whatever apple fanboy.
so, I guess we wont see this on those apple commercials.
Score: 0
|My QT isn't secure. I was on suicidegirls.com and this ugly chick popped up and my computer broke.
I have to give Apple cred though. I really think that DiVX/XViD is the way to go - or MPEG-2 -- but Apple does back Quicktime with a great number of applications that use it and it's very easy to work with for pros and amateurs.
Back onto this topic - I think that BETA NEWS focuses too much on security / patching articles. It would be nice if they extended from BetaNews.com and FileForum.com to having a third site - that focused on vulnerability reports. I find these articles very uninteresting and all they do is promote silly arguments.
I'd be ten times more interested if articles were written about what NEW features are in say ... OpenOffice's nightlies.
Did you know that Copy+Paste from OOo Windows to other applications has really sucked for a while in v2.0? On my own PC and a friend's, we have to wait maybe 30 seconds before CTRL-V doesn't cause a problem. And now it's fixed. And there are other things coming up...
It would be nice if BetaNews.com focused more on news about betas and not news about security patches.
Score: 0
|You have a point about the separate sites idea, but my guess is that they may not have all the server space and capacity in the universe, so until they get enough "demand" for such a thing, why would they spend the extra time and resources on it?
They might even need more staff to do that too, which also means more paychecks. Remember, betanews is a business, and businesses don't throw money into anything unless they believe it will get them more money in the long run :)
...I'm just playing to both sides a little, because I would like to see that as well.
Score: 0
|Quicktime 7, with now 8 vulns, is proving to be the least secure QT yet, by pretty much any measure.
Score: 0
|thanks for your authoritative analysis, ace
Score: 0
|But they're patched, so they're not vulnerabilities anymore! Unless you don't upgrade, but then it's your fault if you get hit...
I'm just gonna grab this for the browser plugin.
Score: 0
|It's a 20 meg "patch" There is no way to simply get a new small delta. For admins that have been "forced" to put itunes on work machines by silly ipod holding VP's, it's a very real PITA.
Score: 0
|Agreed, the ipod services are basically resource hogs as far as I'm concerned. I just disable the service and uncheck the processes in msconfig, but that's a little more work when you are dealing with a network.
Score: 0
|Just use the QT alternative plugin. It's basically just a QT codec without all the QT programs.
Score: 0
|