-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
National Cyber Alert System
Cyber Security Alert SA07-193A
Apple Releases Security Updates for QuickTime
Original release date: July 12, 2007
Last revised: --
Source: US-CERT
Systems Affected
Apple QuickTime for
* Apple Mac OS X
* Microsoft Windows
Overview
Apple has released Apple QuickTime 7.2 to correct several
vulnerabilities. These vulnerabilities could allow an attacker to
gain access to your computer.
Solution
Install an Update
OS X users should use the Mac OS X Software Update feature to
download and install Apple QuickTime 7.2. Consider scheduling
Software Update to check for updates automatically (this option is
enabled by default).
Microsoft Windows users should upgrade to Apple QuickTime 7.2.
Description
QuickTime prior to version 7.2 has multiple image and media file
handling vulnerabilities that could allow an attacker to run
malicious programs on your computer. This could happen by visiting
a malicious web site. Upgrading to Apple QuickTime version 7.2 will
correct these vulnerabilities.
Note that QuickTime ships with Apple iTunes.
For more technical information, see US-CERT Technical Alert
TA07-193A and the Apple QuickTime Security Update.
References
* US-CERT Technical Alert TA07-193A -
<http://www.us-cert.gov/cas/techalerts/TA07-193A.html>
* Vulnerability Notes for QuickTime 7.2 -
<http://www.kb.cert.org/vuls/byid?searchview&query=QuickTime_72>
* About the security content of the QuickTime 7.2 Update -
<http://docs.info.apple.com/article.html?artnum=305947>
* Apple QuickTime 7.2 for Windows -
<http://www.apple.com/support/downloads/quicktime72forwindows.html>
* Apple QuickTime 7.2 for Mac -
<http://www.apple.com/support/downloads/quicktime72formac.html>
* Standalone Apple QuickTime Player -
<http://www.apple.com/quicktime/download/standalone.html>
* Mac OS X: Updating your software -
<http://docs.info.apple.com/article.html?artnum=106704>
* Securing Your Web Browser -
<http://www.us-cert.gov/reading_room/securing_browser/>
_________________________________________________________________
The most recent version of this document can be found at:
<http://www.us-cert.gov/cas/alerts/SA07-193A.html>
_________________________________________________________________
Feedback can be directed to US-CERT Technical Staff. Please send
email to <cert@cert.org> with "SA07-193A Feedback VU#582681" in the
subject.
________________________________________________________________
For instructions on subscribing to or unsubscribing from this
mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
________________________________________________________________
Produced 2007 by US-CERT, a government organization. Terms of use
Terms of use:
<http://www.us-cert.gov/legal.html>
_________________________________________________________________
Revision History
July 12, 2007: Initial release
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iQEVAwUBRpZkovRFkHkM87XOAQL2twf/ZV59ltYywVCkxZA6nw1LZlWwY+dSmhYW
OGviwmW+eyLyuzQqx5A4RcZ0TW5TcBUndODoGA5ILx62kyAqjng2HkIjeTXcvOzS
Fqf7Adwe/i0IAXT3sPCWaYCzGYwn76cWYFd9vgyRyvbFAM7Cmv1u/76GgNSb2R8p
Uc0HbdGy9XOucFgyvFSnNRVlim27pAv5jzkPIBK1817s/TYWIb/NpU4y3+bVtBLF
A3B/Lw+KcRvCSrKe955tMchrghybZ1HYDr7tGokKU1DjlJtvSaOujGSX7O0G/T5g
rCNE+KFqPJY+vIaMbLAxGGhyzyMjRyeocFlBHc37RgWJ1ChvDgNWxg==
=a8Ip
-----END PGP SIGNATURE-----
