Apple’s QuickTime is vulnerable to malware disguised as streaming video, and attack code has been published on the milw0rm.com Web site, security researchers have warned. So far, while the vulnerability affects Windows XP and Windows Vista, the jury is still out on whether Apple’s own OS X is affected.
Apple programmers apparently made two mistakes. First, according to the U.S. Computer Emergency Readiness Team, QuickTime versions 7.2 and 7.3, and perhaps earlier versions, contain a buffer-overflow bug. “Apple QuickTime contains a stack buffer overflow vulnerability in the way QuickTime handles the RTSP Content-Type header,” US-CERT said. “This vulnerability may be exploited by convincing a user to connect to a specially crafted RTSP stream.”
RTSP is the Real-Time Streaming Protocol, which QuickTime supports. When users click on a link for a malicious RTSP stream, an attacker might be able to execute arbitrary code on the compromised system, US-CERT said.
Apple’s popular iTunes software uses QuickTime, so the risk could be quite widespread. While attack code has been published, no actual in-the-wild attacks have been reported.
Mitigating the Risk
There are no direct solutions to such attacks prior to Apple issuing a patch, but US-CERT recommended several practical steps to reduce the risk of attack, including blocking RTSP, disabling the QuickTime ActiveX component for Internet Explorer and QuickTime plug-in for Mozilla, and disabling JavaScript. Finally, US-CERT recommended that users simply not access streaming QuickTime from untrusted sources.
Symantec offered some additional recommendations for network administrators. Enterprises should deploy intrusion-detection systems to monitor network traffic for malicious activity or signs of anomalous activity, the security firm said. Administrators should be on the lookout especially for unexplained incoming and outgoing traffic.
In addition, Symantec said, administrators should run all software as nonprivileged users with minimal access rights and implement multiple redundant layers of security. Symantec also said that…