-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
National Cyber Alert System
Cyber Security Alert SA07-065A
Apple Releases Security Updates for QuickTime
Original release date: March 06, 2007
Last revised: --
Source: US-CERT
Systems Affected
Apple QuickTime for
* Apple Mac OS X
* Microsoft Windows
Overview
Apple has released Apple QuickTime 7.1.5 to correct several
vulnerabilities. These vulnerabilities could allow an attacker to
gain access to your computer.
Description
QuickTime prior to version 7.1.5 has multiple image and media
file handling vulnerabilities that could allow an attacker to run
malicious programs on your computer. This could happen by
visiting a malicious web site. Upgrading to Apple QuickTime
version 7.1.5 will correct these vulnerabilities.
Note that QuickTime ships with Apple iTunes.
For more technical information, see US-CERT Technical Alert and
the Apple QuickTime Security Update.
Solution
Install an Update
OS X users should use the Mac OS X Software Update feature to
download and install Apple QuickTime 7.1.5. Consider scheduling
Software Update to check for updates automatically (this option
is enabled by default).
Microsoft Windows users should upgrade to Apple QuickTime 7.1.5.
References
* US-CERT Technical Alert TA07-065A -
<http://www.us-cert.gov/cas/techalerts/TA07-065A.html>
* Vulnerability Notes for QuickTime 7.1.5 -
<http://www.kb.cert.org/vuls/byid?searchview&query=QuickTime_715>
* About the security content of the QuickTime 7.1.5 Update -
<http://docs.info.apple.com/article.html?artnum=305149>
* Apple QuickTime 7.1.5 for Windows -
<http://www.apple.com/support/downloads/quicktime715forwindows.html>
* Apple QuickTime 7.1.5 for Mac -
<http://www.apple.com/support/downloads/quicktime715formac.html>
* Standalone Apple QuickTime Player -
<http://www.apple.com/quicktime/download/standalone.html>
* Mac OS X: Updating your software -
<http://docs.info.apple.com/article.html?artnum=106704>
* Securing Your Web Browser -
<http://www.us-cert.gov/reading_room/securing_browser/>
____________________________________________________________________
The most recent version of this document can be found at:
<http://www.us-cert.gov/cas/alerts/SA07-065A.html>
____________________________________________________________________
Feedback can be directed to US-CERT Technical Staff. Please send
email to <cert@cert.org> with "SA07-065A Feedback VU#568689" in the
subject.
____________________________________________________________________
For instructions on subscribing to or unsubscribing from this
mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
____________________________________________________________________
Produced 2007 by US-CERT, a government organization.
Terms of use:
<http://www.us-cert.gov/legal.html>
____________________________________________________________________
Revision History
March 06, 2007: Initial release
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iQEVAwUBRe2/O+xOF3G+ig+rAQIsQAf9F+B7uTjrnFX3lBQYrEIuwGxSC/R+kJd5
Cmxy+Y0cbZeuNa52SD4wBVFGKMmJffWMjdPfA8vOwzRpSJTzlV7m3tZptRhww32c
tjrxu81zmmzd71bUk6wJBmH9Cpt9utDVm8wNSIflRjMCE0ueJfRT9Ua8sssQLE3Y
oS2SiULAflVKM4DQFKO4WOb4/OHHA5WZuCDRcn4Q3UXjbuDr4stWi5S8ChgwBV9v
tiWfTorvYHF3HKBsQtbdM5JJlsEJOumav+CsLV5ZlKReSZ15wM/ddygSVf4+OTki
ixLe8PTmNWl2ogT+er2mQPHFGc2rpQNPb3U4+qjcQA9YEl4NMK4dVw==
=pbZu
-----END PGP SIGNATURE-----
