-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
National Cyber Alert System
Cyber Security Alert SA07-334A
Apple QuickTime RTSP Vulnerability
Original release date: November 30, 2007
Last revised: --
Source: US-CERT
Systems Affected
A vulnerability in Apple QuickTime affects
* Apple Mac OS X
* Microsoft Windows
Overview
Apple QuickTime for Microsoft Windows and Apple Mac OS X contains a
vulnerability that could allow an attacker to gain access to your
computer.
Solution
As of November 30, 2007, a QuickTime update for this vulnerability
is not yet available. To help protect your computer, consider the
following workarounds.
Secure your web browser
Following the instructions in Securing Your Web Browser can help
protect you from attacks against this and other web browser
vulnerabilities.
Do not open untrusted QuickTime files
Do not open QuickTime files from any untrusted sources, including
unsolicited files or links received in email, instant messages, web
forums, or internet relay chat (IRC) channels.
Description
Apple QuickTime contains a vulnerability in the way QuickTime
handles multi-media content in Real Time Streaming Protocol (RTSP).
By convincing you to visit a malicious web site or open a malicious
QuickTime file, an attacker could gain access to and take control
of your computer. Common web browsers, including Microsoft Windows,
Mozilla Firefox, and Apple Safari could be used to open a malicious
QuickTime file.
Note that Apple iTunes installs QuickTime, so any system with
iTunes is also vulnerable.
For more technical information, see US-CERT Technical Security
Alert TA07-334A.
References
* US-CERT Technical Alert TA07-334A -
<http://www.us-cert.gov/cas/techalerts/TA07-334A.html>
* Securing Your Web Browser -
<http://www.us-cert.gov/reading_room/securing_browser/>
_________________________________________________________________
The most recent version of this document can be found at:
<http://www.us-cert.gov/cas/alerts/SA07-334A.html>
_________________________________________________________________
Feedback can be directed to US-CERT Technical Staff. Please send
email to <cert@cert.org> with "SA07-334A Feedback VU#659761" in the
subject.
_________________________________________________________________
For instructions on subscribing to or unsubscribing from this
mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
_________________________________________________________________
Produced 2007 by US-CERT, a government organization.
Terms of use:
<http://www.us-cert.gov/legal.html>
_________________________________________________________________
Revision History
November 30, 2007: Initial release
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iQEVAwUBR1AyJ/RFkHkM87XOAQI2kgf6AzT5k8k93Kx0sPSqFzTCZKXyYKcDe2hO
vyRPgUDwt4VdQz/mjnDgJXI3jfO/oi0peE+hNoYeaS+F8MeFkM2Wzjcorh6TefPl
gNobibTPofyps4Aj4hi7YJRBfW5TfvlFn8uUgro6y7iVB7V4UF1aYaQRYp4N4FFl
LJcARIquKDLMcHlcXHtZ59Gdnqm2Ew2ghSCYWBgwZRzAtk2pj4yps80u8b0+0GXC
kGFHe+MhICrTvpl7HtX24Jvr9lOAKJOOzcfF3WRlY64D6YSKkAnFeytcjg7vvASQ
G08xLomdEU19OM6MmI3IC3KiGAhlOyXKhio/rlHE+/rmXhIxeHHp1Q==
=+fFd
-----END PGP SIGNATURE-----
