|
|
iTunes & QuickTime security alert
Author: Gareth HalfacreePublished: 19th September 2008
Both iTunes and QuickTime are vulnerable to a buffer overflow attack when reading maliciously-crafted video files.
According to CNet, the flaw – entered into NIST's National Vulnerability Database with ID CVE-2008-4116 – affects QuickTime 7.5.5 and iTunes 8.0.
The flaw centres around a heap-based buffer overflow which can be exploited via a long-type attribute in a QuickTime tag, either via a maliciously crafted MP4 or MOV video file or embedded within a webpage if the QuickTime browser plugin is installed. As with most buffer overflow vulnerabilities, the flaw can result in mild annoyance – a crash when the program attempts to access memory which is out of bounds – or remote code execution, which is far more serious.
The discovery of this flaw comes shortly after an update was released for issues using iTunes 8 on Windows Vista, and just days after the latest Mac OS X update was made available. Sadly, there's no patch available for this flaw as yet.
If you're hoping for a workaround, the only way to be sure of safety is to avoid using iTunes and QuickTime to play back video and audio files, and to uninstall the QuickTime browser helper component.
Has anyone noticed inexplicable crashes in iTunes over the last few days, or is this likely to be a storm in a teacup and quickly patched by Apple? Share your thoughts over in the forums.
Related
Comments (15)- Site Links:
- About
- Email Editor
- Newsletter
- Privacy
- RSS
- Score Guide
- Our Other Websites:
- Auto Express
- Channel Pro
- Computer Buyer
- Computer Shopper
- Den of Geek
All content © bit-tech.net 2000-2010
© Copyright Dennis Publishing Limited licensed by Felden
Saying just use XXX isn't exactly a viable solution for the millions upon millions of people that use iTunes, iPods, iPhones etc etc.
It's an unfortunate flaw that needs addressing quickly.
When he also suggests an IPod management program (gtkpod), your point becomes seriously redundant.
HAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHA
HAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHA
HAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHA
Oh god. Sorry, But really, I told you guys when the first update came out.
Your problem doesn't exist in the Program. Jus the fact that you actually own a product from this crappy company!
I wonder if the flaw affects earlier versions of the software?
Back in the day, yeah you could get away with a third party program to update your iPod. But these days is that really the best choice? It's not longer about music and playlists, but games, calendars, contacts, notes, etc etc. The whole point of iTunes, iPods and iPhones, is that they just work (or not as in this case). You have software and hardware beautifully tailored to suit each other to a t.
What's so bad about that, that you'd prefer to choose another piece of software over what is the accepted norm in 98% of the case?
What a stupid thing to say.
Really? And what miraculous PC and software do you use, oh wise one, that makes you invulnerable to crashes and security flaws?
Give me a break. Every platform and program has its flaws. It's better to know about them than to live with a delusional sense of safety. Ignorance is not only bliss, it makes you look like an idiot too.