Feeds

QuickTime, not Safari, to blame for MacBook vuln

pwn-2-own update

Intelligent flash storage arrays

Updated The zero-day vulnerability that allowed a hacker to commandeer a brand new MacBook Pro late last week resides in a flaw in Apple's QuickTime media player, the exploit's author says. The revelation corrects descriptions given last Friday that the exploit targeted Safari.

Dino Dai Zovi set the record straight in a blog posting yesterday. It adds that Mac users browsing with Firefox are also vulnerable if QuickTime is installed and that QuickTime may put Java-enabled browsers on Windows machines at risk as well. Several hours after this story was first published, a new entry appeared that said unnamed sources at 3com have determined the QuickTime flaw is also exploitable on Internet Explorer versions 6 and 7.

Secunia has rated the QuickTime flaw highly critical, its second highest rating. "This can be exploited to execute arbitrary code when a user visits a malicious web site," the site warned. It recommends users disable Java as a work around until Apple releases a patch.

On Friday, Shane Macaulay, a friend of Dai Zovi's who participated in a "pwn-2-own" contest at the CanSecWest conference in Vancouver, described the flaw as residing in Safari. Dai Zovi, who wrote the exploit but didn't actually attend the conference, said on Tuesday that the vulnerability in fact lies in the way QuickTime handles Java. The exploit required a machine visit a booby-trapped website in order to work. Dai Zovi spent about nine hours writing the exploit, which allows a hacker to remotely gain full user rights to the targeted machine.

Under the contest rules, a successful exploit entitled the author to go home with the hacked machine. It also nets him a $10,000 bounty from security provider Tipping Point pending confirmation of the finding.

Dai Zovi on Tuesday declined to discuss the QuickTime in detail other than to say it allows a client-side Java error to execute arbitrary code when a Java-enabled browser visits a malicious website.

Dai Zovi's handiwork is only the latest discovery of a QuickTime vulnerability. Last month, Apple issued an update that plugged eight holes in the popular media playback software. ®

Security for virtualized datacentres

More from The Register

next story
PEAK APPLE: iOS 8 is least popular Cupertino mobile OS in all of HUMAN HISTORY
'Nerd release' finally staggers past 50 per cent adoption
Tim Cook: The classic iPod HAD TO DIE, and this is WHY
Apple, er, couldn’t get parts for HDD models
Apple spent just ONE DOLLAR beefing up the latest iPad Air 2
New iPads look a lot like the old one. There's a reason for that
Google Glassholes are UNDATEABLE – HP exec
You need an emotional connection, says touchy-feely MD... We can do that
Microsoft fitness bands slapped on wrists: All YOUR HEALTH DATA are BELONG TO US
Wearable will deliver 'actionable insights for healthier living'
Lawyers mobilise angry mob against Apple over alleged 2011 Macbook Pro crapness
We suffered 'random bouts of graphical distortion' - fanbois
Caterham Seven 160 review: The Raspberry Pi of motoring
Back to driving's basics with a joyously legal high
Back to the ... drawing board: 'Hoverboard' will disappoint Marty McFly wannabes
Buzzing board (and some future apps) leave a lot to be desired
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
The Heartbleed Bug: how to protect your business with Symantec
What happens when the next Heartbleed (or worse) comes along, and what can you do to weather another chapter in an all-too-familiar string of debilitating attacks?