Feeds

QuickTime streaming media exploit targets unpatched bug

Don't RSVP to dodgy RTSP invites

Security for virtualized datacentres

Hackers have created a proof-of-concept exploit for an Apple QuickTime player streaming media vulnerability.

Release of the exploit on Sunday follows hot on the heels of the public disclosure of the as-yet-unpatched buffer overflow bug, which involves the QuickTime RTSP (Real Time Streaming Protocol) Response Header, on 23 November by Polish security researcher Krystian Kloskowski.

Symantec reports that the exploit might be applied to attack users of the latest version of stand-alone QuickTime players (version 7.3), tricked into opening malicious content on hacker-controlled websites. The same attack only crashes the browser of users of QuickTime browser plugins. Email-based attacks featuring attachments with hostile XML code that open a connection to malicious servers are also possible. This attack requires users to double-click on the malicious QuickTime multimedia attachment to run.

Both attacks rely on initiating a RTSP connection on port 554 leading to the transmission of hostile code. Symantec reports that both IE 6 and 7 (as well as Safari 3 block the attack. However, relying on this as a defence may be unwise. "Attackers may attempt to refine the exploit in the coming days in order to overcome this initial hiccup and work to create a reliable exploit that works on Internet Explorer," Symantec notes.

For the meantime, Firefox users are more exposed to the problem, especially if they've selected QuickTime as the default player for multimedia formats.

Pending a patch from Microsoft, users are advised to restrict outbound connections on port TCP 554 using their firewalls, advice that's probably easier to apply in corporate environments. Home users are warned to avoid any temptation to follow links to untrusted websites.

Symantec's write-up of the flaw, featuring screenshots showing the exploit code at work, can be found here. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Microsoft to bake Skype into IE, without plugins
Redmond thinks the Object Real-Time Communications API for WebRTC is ready to roll
Microsoft promises Windows 10 will mean two-factor auth for all
Sneak peek at security features Redmond's baking into new OS
Mozilla: Spidermonkey ATE Apple's JavaScriptCore, THRASHED Google V8
Moz man claims the win on rivals' own benchmarks
FTDI yanks chip-bricking driver from Windows Update, vows to fight on
Next driver to battle fake chips with 'non-invasive' methods
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
Ubuntu 14.10 tries pulling a Steve Ballmer on cloudy offerings
Oi, Windows, centOS and openSUSE – behave, we're all friends here
Was ist das? Eine neue Suse Linux Enterprise? Ausgezeichnet!
Version 12 first major-number Suse release since 2009
Redmond top man Satya Nadella: 'Microsoft LOVES Linux'
Open-source 'love' fairly runneth over at cloud event
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The hidden costs of self-signed SSL certificates
Exploring the true TCO for self-signed SSL certificates, including a side-by-side comparison of a self-signed architecture versus working with a third-party SSL vendor.