-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
National Cyber Alert System
Cyber Security Alert SA06-132B
Apple QuickTime Vulnerabilities
Original release date: May 12, 2006
Last revised: --
Source: US-CERT
Systems Affected
Apple QuickTime for
* Apple Mac OS X
* Microsoft Windows
Overview
Apple has released Apple QuickTime 7.1 to correct several
vulnerabilities. These vulnerabilities could allow an attacker to
gain access to your computer.
Solution
Install an Update
OS X users should use the Mac OS X Software Update feature to
download and install Apple QuickTime 7.1. Consider scheduling
Software Update to check for updates automatically (this option
is enabled by default).
Microsoft Windows users should upgrade to Apple QuickTime 7.1.
Description
QuickTime prior to version 7.1 has multiple image and media file
handling vulnerabilities that could allow an attacker to run
malicious programs on your computer. This could happen by
visiting a malicious web site. Upgrading to Apple QuickTime
version 7.1 will correct these vulnerabilities.
For more technical information, see US-CERT Technical Alert
TA06-132B and the Apple QuickTime Security Update.
References
* US-CERT Technical Alert TA06-132B -
<http://www.us-cert.gov/cas/techalerts/TA06-132B.html>
* Securing Your Web Browser -
<http://www.us-cert.gov/reading_room/securing_browser/>
* Vulnerability Notes for QuickTime 7.1 -
<http://www.kb.cert.org/vuls/byid?searchview&query=QuickTime_7.1>
* About the security content of the QuickTime 7.1 Update -
<http://docs.info.apple.com/article.html?artnum=303752>
* Apple QuickTime 7.1 -
<http://www.apple.com/support/downloads/quicktime71.html>
* Standalone Apple QuickTime Player -
<http://www.apple.com/quicktime/download/standalone.html>
* Mac OS X: Updating your software -
<http://docs.info.apple.com/article.html?artnum=106704>
____________________________________________________________________
The most recent version of this document can be found at:
<http://www.us-cert.gov/cas/alerts/SA06-132B.html>
____________________________________________________________________
Feedback can be directed to US-CERT. Please send email to
<cert@cert.org> with "SA06-132B Feedback VU#289705" in the subject.
____________________________________________________________________
Mailing list information:
<http://www.us-cert.gov/cas/>
____________________________________________________________________
Produced 2006 by US-CERT, a government organization.
Terms of use:
<http://www.us-cert.gov/legal.html>
____________________________________________________________________
Revision History
May 12, 2006: Initial release
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iQEVAwUBRGT/3X0pj593lg50AQKrEAf/axoMyD7tl4iQv3N6xQjuTKxk+oC5o8Hh
cfDUa95ZHCdJLbtZeApRnfivg6M/TZCe/+5RLzojA3KzCM82H7BTjO3guLpLK2xi
TiyCuAP5odxtLrvPIuZQfIQhRP3iUrtpTSOjXjvFXkZeBiqjExS7c5aulSYlw8sl
C0zEZdJyavibbT5b09C3wkA3DB7xYfJfU8M1DzbZaXpAn2p8MEZRgWBL0pMKQLuu
+a7qqFJYSrD6qlbXaWbAzWc9IW/zClixX4mKNRvmIKgj0N8C8/JHV+okU91vwcvA
oPDJt7wqpYnwxeJ4CLnROV99WNb3u1GXc3eMdE8Pjidr3FTWa3xtFQ==
=vHew
-----END PGP SIGNATURE-----
