QuickTime and iTunes DoS exploit released

A new buffer overflow vulnerability could crash the most current version of the applications or allow malicious code to run on a compromised computer. No patch is available.

A serious new flaw was disclosed on Thursday that affects the latest versions of Apple's QuickTime and iTunes applications.

The National Vulnerability Database entry CVE-2008-4116 describes a heap-based buffer overflow vulnerability within Apple's QuickTime 7.5.5 and iTunes 8.0 programs.

To infect a computer, a maliciously coded long-type attribute within a QuickTime tag might be placed on a Web page, or within a .mp4 or .mov file. This could allow remote attackers to crash the applications (known as a denial of service) or possibly execute arbitrary code on a compromised computer.

The announcement comes one week after Apple patched nine security flaws in its media player and fixed Windows Vista problems within its recently updated online music service.

At the moment, there is no recommended workaround or patch available for the code exploit.

Apple did not reply to a request for comment.

Tags:
Security
About the author

    As CNET's former resident security expert, Robert Vamosi has been interviewed on the BBC, CNN, MSNBC, and other outlets to share his knowledge about the latest online threats and to offer advice on personal and corporate security.

     

    Join the discussion

    Conversation powered by Livefyre

    Don't Miss
    Hot Products
    Trending on CNET

    HOT ON CNET

    Love heavy and clunky tablets?

    Said no one ever. CNET brings you the lightest and thinnest tablets on the market.