* Posts by Fred Stella

1 publicly visible post • joined 16 Dec 2007

Apple keeps critical security fixes to itself

Fred Stella
Stop

Sheesh, at least admit that you're wrong

It links to the info, and not only explains the security fixes, but also gives credit to the people who discovered or reported the bugs. Furthermore, your claim that Apple doesn't divulge the problem affects windows is patently false. It's a few pages of info, which wouldn't fit in the software update window. For the people who care, click the link - how is that such an onerous task? For the people who don't care, well, they'll install every update like sheep anyways.

Here's the text of the quicktime update article. Apparently following the link was too hard for El Reg, so I did the job for you.

QuickTime 7.3.1

QuickTime

CVE-ID: CVE-2007-6166

Available for: Mac OS X v10.3.9, Mac OS X v10.4.9 or later, Mac OS X v10.5 or later, Windows Vista, XP SP2

Impact: Viewing a maliciously crafted RTSP movie may lead to an unexpected application termination or arbitrary code execution

Description: A buffer overflow exists in QuickTime's handling of Real Time Streaming Protocol (RTSP) headers. By enticing a user to view a maliciously crafted RTSP movie, an attacker may cause an unexpected application termination or arbitrary code execution. This update addresses the issue by ensuring that the destination buffer is sized to contain the data.

QuickTime

CVE-ID: CVE-2007-4706

Available for: Mac OS X v10.3.9, Mac OS X v10.4.9 or later, Mac OS X v10.5 or later, Windows Vista, XP SP2

Impact: Viewing a maliciously crafted QTL file may lead to an unexpected application termination or arbitrary code execution

Description: A heap buffer overflow exists in QuickTime's handling of QTL files. By enticing a user to view a maliciously crafted QTL file, an attacker may cause an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking.

QuickTime

CVE-ID: CVE-2007-4707

Available for: Mac OS X v10.3.9, Mac OS X v10.4.9 or later, Mac OS X v10.5 or later, Windows Vista, XP SP2

Impact: Multiple vulnerabilities in QuickTime's Flash media handler

Description: Multiple vulnerabilities exist in QuickTime's Flash media handler, the most serious of which may lead to arbitrary code execution. With this update, the Flash media handler in QuickTime is disabled except for a limited number of existing QuickTime movies that are known to be safe. Credit to Tom Ferris of Adobe Secure Software Engineering Team (ASSET), Mike Price of McAfee Avert Labs, and security researchers Lionel d'Hauenens & Brian Mariani of Syseclabs for reporting this issue.