More Java Security Problems Found in QuickTime 7.1.6

By Lisa Vaas  |  Posted 2007-05-30 Print this article Print

This is the second time this month that Apple has fixed QuickTime holes.

Apple is recommending that all QuickTime users—both on Windows and Mac OS X—download its update for Version 7.1.6 to fix a pair of security glitches. The company posted the updates on May 29. One of the first two problems, in QuickTime for Java, can lead users to having their systems hijacked if they visit a malicious site. The flaw can allow instantiation or manipulation of objects outside of the bounds of the allocated heap. If a user gets lured to a site containing a maliciously crafted Java applet, an attacker can trigger the vulnerability and take over the target system. The second glitch also is related to QuickTime for Java in that a Web browsers memory can be read by a Java applet. Like the other problem, a user has to visit a site with a maliciously crafted Java applet. Upon luring a victim to such a site, an attacker can take advantage of the vulnerability and thereby may be able to read sensitive information off the victims system.
This is the second time this month that Apple has fixed QuickTime holes. Earlier in May, Apple patched the QuickTime hole that allowed hackers at the CanSecWest security show to take over a MacBook Pro in a Pwn-2-Own contest on April 20.
That earlier hole was a serious one: Terri Forslof, manager of security response at TippingPoint, compared it to the Windows animated cursor vulnerability in terms of impact and the possibility of system hijacking to which both flaws can lead. Read more here about Apple patching 17 bugs. "The method of attack is the same as what Microsoft calls Click and youre owned. You get an e-mail, visit a malicious Web site and boom, youre owned. Where theres still that one-step user interaction, its still a serious vulnerability. Anytime you illegally break into a machine, its a hack," Forslof said at the time. As in one of the two QuickTime flaws that Apple fixed on May 29, the pwn-2-own hole fixed earlier in the month involved a problem with implementation of QuickTime for Java that allowed reading or writing out of the bounds of the allocated heap, and it also worked by enticing a user to visit a site containing a maliciously crafted Java applet. Apple has the details of the security updates here on its Security Update page. The updates are on Apples Download page. Check out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEKs Security Watch blog.
Lisa Vaas is News Editor/Operations for and also serves as editor of the Database topic center. Since 1995, she has also been a Webcast news show anchorperson and a reporter covering the IT industry. She has focused on customer relationship management technology, IT salaries and careers, effects of the H1-B visa on the technology workforce, wireless technology, security, and, most recently, databases and the technologies that touch upon them. Her articles have appeared in eWEEK's print edition, on, and in the startup IT magazine PC Connection. Prior to becoming a journalist, Vaas experienced an array of eye-opening careers, including driving a cab in Boston, photographing cranky babies in shopping malls, selling cameras, typography and computer training. She stopped a hair short of finishing an M.A. in English at the University of Massachusetts in Boston. She earned a B.S. in Communications from Emerson College. She runs two open-mic reading series in Boston and currently keeps bees in her home in Mashpee, Mass.

Submit a Comment

Loading Comments...
Manage your Newsletters: Login   Register My Newsletters

Rocket Fuel