Critical vulnerability found in quick Time

30th November 2007

A dangerous vulnerability is found in the mediaplayer QuickTime from Apple, which theoretically allows seizing the complete control over a remote computer.
According to the Danish company Secunia, the problem relates to the processing of stream videos server`s replies on the protocol RTSP (Real Time Streaming Protocol). With the help of the specially formed package, an attacker can trigger buffer overflow on the victim`s machine and then execute arbitrary malicious code.
The Specialists of Secunia assigned the hole with the maximum danger rating. The problem is getting worse by the fact that the Web is already full of possible examples of software code to organize attacks. The gap is present in the recently released version of QuickTime 7.3 and, possibly, in older versions of the program. There is no patch released so far.
It is worth while saying that Apple has already eliminated 7 vulnerabilities in the player QuickTime 7.3, six of which could theoretically be used to implement an arbitrary malicious code on the victim's computer. The holes, in particular, were found in the mechanisms of processing videos and graphics files in the PICT format.