- BlackBerry Storm vs. the iPhone
- Digg's Kevin Rose: "We have to do better"
- Blogger warns: "Nortel doesn't make it out alive"
- Financial quagmire bringing out the scammers
- Verizon plays with the wrong e-mail addresses
Newsletters | Podcasts | Chats | Opinions | RSS Feeds | This Week In Print | IT Careers | Community | Reports | Downloads | Slideshows | New Data Center
Partner Sites:Application Performance Solutions | App Performance | Networking Solution | SafeGuard Enterprise Solution Center | SOA | Test your Web Filter | Value of WDS
Apple Tuesday released new versions of QuickTime for both Mac OS X and Windows to plug a hole discovered during a hack challenge last month.
QuickTime 7.1.6 patches the vulnerability exploited by Dino Dai Zovi on April 20 to break into a MacBook Pro at the CanSecWest security conference. For his efforts, Dai Zovi took home a $10,000 prize offered by TippingPoint, which operates a bug bounty program called Zero Day Initiative.
The flaw lies in QuickTime's implementation of Java, said Apple's accompanying advisory. The bug could be exploited by duping users running a Java-enabled browser -- including Apple's own Safari, Mozilla's Firefox and Microsoft's Internet Explorer -- to a malicious Web site. Systems running Mac OS X 10.3.9 or 10.4.9, as well as PCs with Windows 2000, Windows XP, and Windows Vista were at risk of being hijacked if the music player program was present.
In its own advisory, TippingPoint pointed to the QuickTime Java extensions, "QTJava.dll," as the file containing the buggy code. Apple credited both Dai Zovi and TippingPoint in its advisory.
During the 12-day saga, the vulnerability was first reported to be in Safari and only on Mac OS X; within days, however, researchers confirmed that the bug could be exploited through other browsers and on Windows because QuickTime was the cause. A day later, rumors circulated that the exploit had been snatched at CanSecWest by grabbing packets transferred over a wireless network. Those reports were quickly discounted, however, by conference organizers.
As recently as earlier Tuesday, Gartner analysts slammed the practice of hosting public bug challenges, saying that such events violate the concept of "responsible disclosure." TippingPoint's security research manager disputed the argument, saying that the vulnerability and its exploit were never in the public domain.
Also Tuesday, Apple re-released last month's security update to fix a pair of problems introduced by the original, including one that dropped a wireless connection after a Mac OS X 10.3.9 system came out of sleep mode.
QuickTime 7.1.6 can be downloaded for Macs and Windows-based systems from Apple's Web site.
| NetworkWorld, Inc. | About Network World, Inc. | Advertise | Careers | Contact us | Terms of Service/Privacy | Reprints and links | Partnerships | Press room | Subscribe to NW |
| IDG, Inc. | CIO | Computerworld | CSO | Demo | GamePro | Games.net | IDGconnect.com | IDG World Expo | Infoworld | JavaWorld.com | LinuxWorld.com | MacUser | Macworld | PC World | Playlistmag.com | The Industry Standard | IDG List Services | IDG TechNetwork |
 |
Copyright © 1994-2008 Network World, Inc. All rights reserved. |
Partner Content
Brilliantly simple security and control solutions for email, web and endpoint
www.sophos.com
Stopping data leakage
Learn how to exploit your current security investment to control the information that flows into, through and out of your network.
Download the white paper.
Why detection rates aren't enough
Evaluating endpoint security products is a time-consuming and daunting task. Learn the six critical questions you need to ask prospective vendors to get the right endpoint solution.
Download the white paper.
Applications: taking back control
Employees installing unauthorized applications is a growing threat to business security and productivity. Cost-effectively reduce this threat by integrating control into your malware protection.
Learn more today.
Comment