Well the Month of Apple Bugs seems to have started with a Quicktime bug that affects Windows and OS X. Apparently this exploit can be remotely executed and causes a stack overflow allowing arbitrary code to be executed. It can be neutered by turning off RTSP URL's:
http://isc.sans.org/diary.php?storyid=1993
Theoretically, you could go to a malicious website that will automatically launch Quicktime to play a stream that will exploit the hole. However, the code does not seem to work. I have tried a few test links and none of them actually did anything except display some XML jibberish in my browser. There are also many other reports of people trying to write their own code and the only results they could achieve were crashing Quicktime. So as far as this bug is concerned, I do not think it is time to worry yet.
-
-
Nice catch cash. I know that these type of exploits have been around for a while and can be pretty bad on Windows.
Month of Apple Bugs
Discussion in 'Apple and Mac OS X' started by cashmonee, Jan 2, 2007.