-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
National Cyber Alert System
Cyber Security Alert SA06-011A
Apple QuickTime Vulnerabilities
Original release date: January 11, 2006
Last revised: --
Source: US-CERT
Systems Affected
Apple QuickTime for
* Apple Mac OS X
* Microsoft Windows XP
* Microsoft Windows 2000
Overview
Apple has released Apple QuickTime 7.0.4 to correct several
vulnerabilities. These vulnerabilities could allow an attacker to
gain access to your computer.
Solution
Install an Update
OS X users should use the Mac OS X Software Update feature to
download and install Apple QuickTime 7.0.4. Consider scheduling
Software Update to check for updates automatically (this option is
enabled by default).
Microsoft Windows users should upgrade to Apple QuickTime 7.0.4.
Description
QuickTime prior to version 7.0.4 has multiple image and media file
handling vulnerabilities that could allow an attacker to run
malicious programs on your computer. Upgrading to Apple QuickTime
version 7.0.4 will correct these vulnerabilities.
For more technical information, see US-CERT Technical Alert
TA06-011A and the Apple QuickTime Security Update.
References
* Apple QuickTime 7.0.4 -
<http://www.apple.com/support/downloads/quicktime704.html>
* Security content of QuickTime 7.0.4 -
<http://docs.info.apple.com/article.html?artnum=303101>
* US-CERT Technical Alert TA06-011A -
<http://www.us-cert.gov/cas/techalerts/TA06-011A.html>
* US-CERT Vulnerability Note -
<http://www.kb.cert.org/vuls/id/115729>
* US-CERT Vulnerability Note -
<http://www.kb.cert.org/vuls/id/150753>
* US-CERT Vulnerability Note -
<http://www.kb.cert.org/vuls/id/629845>
* US-CERT Vulnerability Note -
<http://www.kb.cert.org/vuls/id/921193>
* US-CERT Vulnerability Note -
<http://www.kb.cert.org/vuls/id/913449>
* Mac OS X: Updating your software -
<http://docs.info.apple.com/article.html?artnum=106704>
____________________________________________________________________
The most recent version of this document can be found at:
<http://www.us-cert.gov/cas/alerts/SA06-011A.html>
____________________________________________________________________
Feedback can be directed to US-CERT Technical Staff. Please send
email to <cert@cert.org> with "SA06-011A Feedback VU#913449" in the
subject.
____________________________________________________________________
For instructions on subscribing to or unsubscribing from this
mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
____________________________________________________________________
Produced 2006 by US-CERT, a government organization.
Terms of use:
<http://www.us-cert.gov/legal.html>
____________________________________________________________________
Revision History
Jan 11, 2006: Initial release
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iQEVAwUBQ8WEsn0pj593lg50AQJvFAgAz1X/84ZOVkyJLHAiCD9jlLqxZyadmTgv
GzB1cAlUAKmGFG9xqmqetlqyWK6vdtQx7lNXo4oZLEbKCI/jXfYXa4Ha2pIQz12B
7Tm5iLC6whS7RqQjlqinq/uEhj3LBnDtbM8VXLfMXMqROZxARK2bKVibRoj6IaLU
dTE6OL7XCJcKs8GcFKUOjseRLMc4QlF+zdefxmN/m+YJStQmWbW6yjYYiHWdaSo0
25KeRkp7Vpf5Uw0+R7g1iu9oB3SDvv8vG8RDflFriZhqj+elY0UQ9tYE39nWjY9J
JlUrIr+odzrdnKBo9flKYdMmIUFzjQDOVw0+cdBcbJGgcOfIyKDRdQ==
=Zz+Y
-----END PGP SIGNATURE-----
