Unsolved
This post is more than 5 years old
5 Journeyman
•
15.6K Posts
•
45K Points
0
5255
February 7th, 2008 11:00
Apple QuickTime 7.4.1 released, to fix highly critical vulnerabilities
from http://secunia.com/advisories/28423/
Description:
Luigi Auriemma has reported a vulnerability in Apple QuickTime, which potentially can be exploited by malicious people to compromise a user's system.
The vulnerability is caused due to a boundary error when handling RTSP replies and can be exploited to cause a heap-based buffer overflow via e.g. sending a specially crafted reply containing an overly-long "Reason-Phrase".
Successful exploitation may allow execution of arbitrary code, but requires that the user is e.g. tricked into opening a malicious QTL file or visiting a malicious web site.
The vulnerability is reported in version 7.3.1.70. Other versions may also be affected.
Solution:
Update to QuickTime 7.4.1.
http://www.apple.com/quicktime/download/
for windows XP or Vista (not 2000, or earlier)
Dave Lyle
2 Intern
•
2K Posts
0
February 7th, 2008 16:00
And they no longer seem to make a Quicktime standalone install available. They are really pushing Itunes. I will not install Itunes on my machine.
I did find a place where you can still get the standalone installer:
http://it.cas.psu.edu/459.htm
Bugbatter
4 Apprentice
•
20.5K Posts
0
February 7th, 2008 17:00
ky331
5 Journeyman
•
15.6K Posts
•
45K Points
0
February 7th, 2008 17:00
the link i gave above, while defaulting to QuickTime+Itunes, has "buttons" where you can opt for just the QuickTime Player (withOUT Itunes).
I have installed the new QT player "over" the old one (without going through an uninstall)... i believe that the installer looks for older versions, and automatically removes them first.
Dave Lyle
2 Intern
•
2K Posts
0
February 7th, 2008 20:00