US-CERT Cyber Security Alert SA06-256A -- Apple QuickTime Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


                     National Cyber Alert System

                   Cyber Security Alert SA06-256A


Apple QuickTime Vulnerabilities

   Original release date: September 13, 2006
   Last revised: --
   Source: US-CERT


Systems Affected

   Apple QuickTime for

     * Apple Mac OS X
     * Microsoft Windows


Overview

     Apple has released Apple QuickTime 7.1.3 to correct several
     vulnerabilities. These vulnerabilities could allow an attacker to
     gain access to your computer.


Solution

  Install an Update

     OS X users should use the Mac OS X Software Update feature to
     download and install Apple QuickTime 7.1.3. Consider scheduling
     Software Update to check for updates automatically (this option
     is enabled by default).

     Microsoft Windows users should upgrade to Apple QuickTime 7.1.3.


Description

     QuickTime prior to version 7.1.3 has multiple image and media
     file handling vulnerabilities that could allow an attacker to run
     malicious programs on your computer. This could happen by
     visiting a malicious web site. Upgrading to Apple QuickTime
     version 7.1.3 will correct these vulnerabilities.

     Note that QuickTime is included with Apple iTunes.

     For more technical information, see US-CERT Technical Alert
     TA06-256A and the Apple QuickTime Security Update.


References

     * US-CERT Technical Alert TA06-256A -
       <http://www.us-cert.gov/cas/techalerts/TA06-256A.html>

     * Vulnerability Notes for QuickTime 7.1.3 -
       <http://www.kb.cert.org/vuls/byid?searchview&query=QuickTime_713>

     * About the security content of the QuickTime 7.1.3 Update -
       <http://docs.info.apple.com/article.html?artnum=304357>

     * Apple QuickTime 7.1.3 -
       <http://www.apple.com/support/downloads/quicktime713.html>

     * Standalone Apple QuickTime Player -
       <http://www.apple.com/quicktime/download/standalone.html>

     * Mac OS X: Updating your software -
       <http://docs.info.apple.com/article.html?artnum=106704>

     * Securing Your Web Browser -
       <http://www.us-cert.gov/reading_room/securing_browser/>

     * Mac OS X: Updating your software -
       <http://docs.info.apple.com/article.html?artnum=106704>


 ____________________________________________________________________

   The most recent version of this document can be found at:

     <http://www.us-cert.gov/cas/alerts/SA06-256A.html>
 ____________________________________________________________________

   Feedback can be directed to US-CERT. Please send email to
   <cert@cert.org> with "SA06-256A Feedback VU#540348" in the subject.
 ____________________________________________________________________

   Mailing list information:

     <http://www.us-cert.gov/cas/>
 ____________________________________________________________________

   Produced 2006 by US-CERT, a government organization.

   Terms of use:

     <http://www.us-cert.gov/legal.html>
 ____________________________________________________________________


Revision History

   September 13, 2006: Initial release

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iQEVAwUBRQg44OxOF3G+ig+rAQI+/wf/QdAxWPQpX5oT8CpmhreCBgQDhYGGgSmD
bTSZ0tGKaAgW1Q61Ei0tHkFF3Nb/70YvXu7fmGwHtdwrwEm5eOAe/F485n6Kwvnn
dkGLripZuMvd/vFQUvmOBZmJxhuW1IpdQn8KxXfDqtz3fsLkA68xX3sFkACq9wYc
Ihp8efBZtARYOLavhMJbzwTL+9Z0v4sCVZFvH6D5/TNVY25JHex1S+WIQbMv148w
AcfNt1dSzABCHt9KjcxgREb9Mc7lp+CGIgkP1thl/QUflLhOPgeZhXJUAsgxroNO
rNxDejSrjSeAQeGX4LR/UbyioKwg1V9mWCAK7/vPhqLMNOegVHuMmQ==
=wGC3
-----END PGP SIGNATURE-----