Feeds

QuickTime, not Safari, to blame for MacBook vuln

pwn-2-own update

Gartner critical capabilities for enterprise endpoint backup

Updated The zero-day vulnerability that allowed a hacker to commandeer a brand new MacBook Pro late last week resides in a flaw in Apple's QuickTime media player, the exploit's author says. The revelation corrects descriptions given last Friday that the exploit targeted Safari.

Dino Dai Zovi set the record straight in a blog posting yesterday. It adds that Mac users browsing with Firefox are also vulnerable if QuickTime is installed and that QuickTime may put Java-enabled browsers on Windows machines at risk as well. Several hours after this story was first published, a new entry appeared that said unnamed sources at 3com have determined the QuickTime flaw is also exploitable on Internet Explorer versions 6 and 7.

Secunia has rated the QuickTime flaw highly critical, its second highest rating. "This can be exploited to execute arbitrary code when a user visits a malicious web site," the site warned. It recommends users disable Java as a work around until Apple releases a patch.

On Friday, Shane Macaulay, a friend of Dai Zovi's who participated in a "pwn-2-own" contest at the CanSecWest conference in Vancouver, described the flaw as residing in Safari. Dai Zovi, who wrote the exploit but didn't actually attend the conference, said on Tuesday that the vulnerability in fact lies in the way QuickTime handles Java. The exploit required a machine visit a booby-trapped website in order to work. Dai Zovi spent about nine hours writing the exploit, which allows a hacker to remotely gain full user rights to the targeted machine.

Under the contest rules, a successful exploit entitled the author to go home with the hacked machine. It also nets him a $10,000 bounty from security provider Tipping Point pending confirmation of the finding.

Dai Zovi on Tuesday declined to discuss the QuickTime in detail other than to say it allows a client-side Java error to execute arbitrary code when a Java-enabled browser visits a malicious website.

Dai Zovi's handiwork is only the latest discovery of a QuickTime vulnerability. Last month, Apple issued an update that plugged eight holes in the popular media playback software. ®

Next gen security for virtualised datacentres

More from The Register

next story
So, Apple won't sell cheap kit? Prepare the iOS garden wall WRECKING BALL
It can throw the low cost race if it looks to the cloud
Reg man looks through a Glass, darkly: Google's toy ploy or killer tech specs?
Tip: Put the shades on and you'll look less of a spanner
Apple promises to lift Curse of the Drained iPhone 5 Battery
Have you tried turning it off and...? Never mind, here's a replacement
Now that's FIRE WIRE: HP recalls 6 MILLION burn-risk laptop cables
Right in the middle of Burning Mains Man week
Apple's iWatch? They cannae do it ... they don't have the POWER
Analyst predicts fanbois will have to wait until next year
HUGE iPAD? Maybe. HUGE ADVERTS? That's for SURE
Noo! Hand not big enough! Don't look at meee!
Samsung Gear S: Quick, LAUNCH IT – before Apple straps on iWatch
Full specs for wrist-mounted device here ... but who'll buy it?
AMD unveils 'single purpose' graphics card for PC gamers and NO ONE else
Chip maker claims the Radeon R9 285 is 'best in its class'
One step closer to ROBOT BUTLERS: Dyson flashes vid of VACUUM SUCKER bot
Latest cleaner available for world+dog in September
prev story

Whitepapers

Best practices for enterprise data
Discussing how technology providers have innovated in order to solve new challenges, creating a new framework for enterprise data.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?