Sunday, May 16, 2021

Apple Secures QuickTime

QuickTime users can breathe a collective sigh of relief. After weeks of
being at risk from an unpatched security vulnerability, Apple yesterday addressed the hole in its media-playing software.

Among the trio of vulnerabilities fixed in the QuickTime 7.3.1 release is a flaw first publicly reported nearly a month ago, involving Real Time Streaming Protocol (RTSP) headers. The severity of the problem triggered a
US-CERT Technical Cyber Security Alert
two weeks ago.

Apple’s QuickTime 7.3.1 security advisory noted that the newest update fixes
the RTSP issue by “ensuring that the destination buffer is sized to contain the data.” The RTSP flaw could have allowed an attacker to trigger a buffer overflow that could lead to a system crash or arbitrary code execution.

The second flaw fixed by Apple in the QuickTime 7.3.1 update also related to a buffer overflow. In this case, the flaw resided in how QuickTime handled QTL (QuickTime Link) files. Apple claims to have fixed the issue with improved checking of the file.

The last flaw addressed by the QuickTime update deals with how QuickTime handles Adobe’s Flash media. Apple’s advisory noted that there are multiple vulnerabilities in QuickTime’s Flash media handler.

However, the fix for this issue doesn’t involve Apple actually addressing the reasons why the Flash handler is insecure. Instead, to eliminate the threat, Apple disabled the Flash media handler in QuickTime entirely.

The QuickTime 7.3.1 update marks the third update for the media-playing software from Apple in three months. Both the 7.2 and the 7.3 releases dealt with media-handling issues as well.

QuickTime 7.3.1 is available as a free download from the Apple Downloads site.

This article was first published on

Similar articles

Latest Articles

How IBM has Changed...

Think is IBM’s big annual conference, and again this year, it was digital. I’m noticing a sharp quality difference in shows like this where...

Database-Tuning Platform Launches and...

PITTSBURGH — A team out of Carnegie Mellon University is launching its automatic database-tuning product today with the help of $2.5 million in funding.   OtterTune,...

Top 10 Professional Services...

Professional services automation (PSA) software aims to offer service-based companies most of the software they will need to run their businesses in one package....

What is Data Aggregation?

Data aggregation is the process where raw data is gathered and presented in a summarized format for statistical analysis. The data may be gathered...