Critical vulnerability in QuickTimes threatens Second Lifeâ€™s players

18th December 2007

The developers of one of the world's most popular multi-players online games Second Life, the studio of Linden, reported the critical vulnerability found in Appleâ€™s QuickTime.
One would wonder what Second Life has to o with that? However QuickTime is used in the client to work with Second Life to play video and listen to music in the virtual world. The essence of the vulnerability is a buffer overflow in QuickTime, allowing an attacker to get full control over the userâ€™s character in the game online. However, it must be stressed, that the discovered vulnerability concerns not only Second Life, but any software using QuickTime.
According to the developers of Second Life, the use of real vulnerability has not been fixed so far, but until Apple eliminates the "hole", the players are strongly advised to disable playback of streaming video and not to keep big sums of money on their game accounts. It is reported, that an attacker is sufficient to hold a virtual character in the immediate vicinity of the victim's avatar.