-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
National Cyber Alert System
Cyber Security Alert SA08-016A
Apple QuickTime Updates for Multiple Vulnerabilities
Original release date: January 16, 2008
Last revised: --
Source: US-CERT
Systems Affected
* Apple Mac OS X running versions of QuickTime prior to 7.4
* Microsoft Windows running versions of QuickTime prior to 7.4
Overview
Apple has released Apple QuickTime 7.4 to correct several
vulnerabilities. These vulnerabilities could allow an attacker to
gain access to your computer.
Solution
Upgrade QuickTime
OS X users should use the Mac OS X Software Update feature to
download and install Apple QuickTime 7.4. Consider scheduling
Software Update to check for updates automatically (this option is
enabled by default).
Microsoft Windows users should upgrade to Apple QuickTime 7.4.
Description
QuickTime prior to version 7.4 has multiple image and media file
handling vulnerabilities that could allow an attacker to run
malicious programs on your computer. This could happen by visiting
a malicious web site. Upgrading to Apple QuickTime version 7.4 will
correct these vulnerabilities.
Note that Apple iTunes installs QuickTime, so any system with
iTunes is vulnerable.
For more technical information, see US-CERT Technical Security
Alert TA08-016A.
References
* US-CERT Technical Alert TA08-016A -
<http://www.us-cert.gov/cas/techalerts/TA08-016A.html>
* About the security content of the QuickTime 7.4 Update -
<http://docs.info.apple.com/article.html?artnum=307301>
* Apple QuickTime 7.4 for Windows -
<http://www.apple.com/support/downloads/quicktime74forwindows.html>
* Apple - QuickTime - Download
<http://www.apple.com/quicktime/download/>
* Mac OS X: Updating your software -
<http://docs.info.apple.com/article.html?artnum=106704>
* Securing Your Web Browser -
<http://www.us-cert.gov/reading_room/securing_browser/>
_________________________________________________________________
The most recent version of this document can be found at:
<http://www.us-cert.gov/cas/alerts/SA08-016A.html>
_________________________________________________________________
Feedback can be directed to US-CERT Technical Staff. Please send
email to <cert@cert.org> with "SA08-016A Feedback VU#818697" in the
subject.
_________________________________________________________________
For instructions on subscribing to or unsubscribing from this
mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
_________________________________________________________________
Produced 2007 by US-CERT, a government organization.
Terms of use:
<http://www.us-cert.gov/legal.html>
_________________________________________________________________
Revision History
January 16, 2008: Initial release
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iQEVAwUBR45upPRFkHkM87XOAQKhhwgAmZ2ejQgPk90QnN/8bVePUEnxm4Wz2VdH
MJLFqVkeb6PHqKe3sA2g0a+Vq2ONrVGNXQNs427OVRa3uiyEcH0t+bFGx9EAiKU3
IMrAGdQQrsI72Leo8JehrtXyvJCJCB42dJNIlSmP9JNfF8dBRi0e/fogQSIItgcc
EAqBgxlb63SnSJP9WMOV+OcnoOWy20jdEPmMCRqjpGWgcsue4nTh273eZcVZlfS9
cMbNHVcWUyhDcz12V3O7qeAxbZnQGL0UnzftTKyUeRdm7Go1i6ZXgPuJWuYUqRCk
BGBQ9YFJiBxZZkAQwFB+aJAb0nqXu9CcR3RSW9c5UMScf+Gab0Ze8Q==
=Rf0u
-----END PGP SIGNATURE-----
