QuickTime Bug Gives Hackers New Drive-by Attack

[Hairbautt]

"The bug, when paired with Firefox, allows hackers to hijack PCs and Macs."

"A year-old bug in QuickTime that, when paired with Firefox allows, hackers to hijack PCs and Macs now has Mozilla Corp. scrambling for a fix, the company's chief security officer said Wednesday.

According to Petko Petkov, a U.K.-based Web application penetration tester, the current version of QuickTime contains a flaw in its Media Link (.qtl file formats) function. Any file with a QuickTime-supported extension -- there are more than 60 -- will be parsed by Apple Inc.'s media player. However, because it fails to sanitize the XML content, an attack can sneak links to malicious JavaScript into the file, and get QuickTime to run it."

For more information visit:

Source: PCWorld

[sear]

Already protected thanks to noscript still it's always a concern when something like this comes out, makes me wonder about what other problems they haven't found out about yet.

[peat moss]

I always hated QuickTime, just the way it try's to take over all your vid and pic files . I was wondering if Klite's pack with Quicktime alternative has the same issue .