Apple QuickTime under siege

Not counting silent (undocumented) fixes, Apple has patched at least 32 security flaws affecting QuickTime in 2007. Last year, the QuickTime patch count was 28. Five were documented in 2005.

Judging by the public release of details — and exploit code — for zero-day flaws affecting the company’s flagship media player, it looks like the number will rise again in 2008.

Take a quick peek at Milw0rm.com, a popular security research site that hosts proof-of-concept exploit code. At the moment, there are four different remote exploits for unpatched QuickTime vulnerabilities.

Apple QuickTime under siege

Lower down the page, there are two more proof-of-concepts for denial-of-service holes. These affect both Windows and Mac OS X users, increasing the likelihood that in-the-wild attacks against unpatched QuickTime holes will soon appear.

The latest zero-day, a stack buffer overflow vulnerability in the way QuickTime handles the RTSP (Real Time Streaming Protocol) Content-Type header, is among the more serious flaws affecting QuickTime this year.

It affects most versions of QuickTime prior to and including 7.3 running on all supported Apple Mac OS X and Microsoft Windows platforms. Since QuickTime is a component of Apple iTunes, iTunes installations are also affected by this vulnerability.

A US-CERT advisory spells out the risks:

An attacker could exploit this vulnerability by convincing a user to access a specially crafted HTML document such as a Web page or e-mail message. The HTML document could use a variety of techniques to cause QuickTime to load a specially crafted RTSP stream. Common Web browsers, including Microsoft Internet Explorer, Mozilla Firefox, and Apple Safari can be used to pass RTSP streams to QuickTime, exploit the vulnerability, and execute arbitrary code.

This vulnerability could allow a remote, unauthenticated attacker to execute arbitrary code or commands and cause a denial-of-service condition.

The sharp rise in QuickTime flaw discoveries has set tongues wagging in security research circles and calls into question Apple’s code review process.

“QuickTime is the new IE and Apple is the new Microsoft,” said a researcher who works closely with both companies on vulnerability reports.

Those comparisons aren’t far-fetched. QuickTime, like Internet Explorer, is ubiquitous on Windows and often run in an unpatched state for long periods — on both home and business computers. Apple, like Microsoft, has attracted scorn among some flaw finders for its slow response to serious issues — and publicly documented squabbles with researchers.

Now there are calls for Apple to beef up its anti-exploitation protection mechanisms. Former Gartner analyst Rich Mogull, now an indie consultant at Securosis.com, offers the following advice:

This situation highlights why it’s so important for Apple to finish some of the security improvements they started implementing in Leopard. Both library randomization and sandboxing can help prevent exploits of vulnerabilities like this. If Apple were to add outbound blocking to the application firewall, it would let us block these kinds of attacks without having to know anything about ports and protocols. Apple is clearly on the right path, and I look forward to future updates that will keep me protected even when a new, unpatched vulnerability is in the wild.

Better yet, Apple might want to (gasp!) borrow a page from Microsoft’s playbook and implement an entire SDL (Security Development Lifecycle) process to cut down on flaws and reduce the attack surface when zero-days emerge.

» Apple QuickTime under siege | Ryan Naraine’s Zero Day | ZDNet.com

still think Macs are invulnerable to attacks mac lovers?

__________________
Proud Member of Naked Toasties Club

Arcángel

At Home on the Toast (48)

Activity1553/1553

 

Addiction1418/5358

 

Progress Bar76%

 

I hate to say I told you so to all of the Mac lovers out there but, I told you so.

Ever since Mac OS X was released and with Apple resting their hopes on a UNIX backbone, people were convinced that the majority of the ailments that played havoc among the PC demographic would not even put a dent in in their false sense of security. Now, with these new security flaws in QuickTime (whoopty fuckin doo), it seems to me that people are beginning to see that Apple's Mac OS X is, in itself, a regular operating system, prone to the same ideocincricies of any other operating system.

Their way of crashing is simular, Mac and UINIX have the Kernel Panic, Windows has the Blue Screen of Death. Either way, they are all caused from an EXCEPTION that was unhandled, that cannot be recovered from which necessitates the user to restart the operating system.

As for viruses and other sort of vulnerabilities, whatever compilation of source code, be it a web oriented language, an application or something as complex and as elaborate as an operating system, there is always going to be some sort of hole to patch, a vulnerability to protect against or a bug in the code to work around. Apple, as you can see is obviously of no exception (no pun intended lol). Not to mention that the majority of the streams these days still use RTSP as a means of streaming audio and video, regardless of the operating system.

Now, I wonder how long it will take for it to hit that the grass in front of Apple's headquarters, 1 Infinite Loop, isn't exactly as green as once percieved?

__________________

Mi Familia
Formerly known as El Subestimado
Mi ma'i, mi amor de mi vida: SpicedSugar
Mis hijos: Butterfingered (missing)
Mi hermanita: Dancesintheran, my brother-in-law: Edge_Of_Insanity
Mi Primita: Keena

eDgE oF iNsAnItY

The Better of Most (39)

Activity721/969

 

Addiction808/5062

 

Progress Bar75%

 

Well as far as viruses affecting PCs and not Macs, it's only becuase most of the world uses Windows, so if you are a hacker wanting to wreak havoc, it would only make since to write the code to affect windows, thus damaging the most amount of systems. It has nothing to do with either platforms superiority or inferiority...

__________________

Arcángel

At Home on the Toast (48)

Activity1553/1553

 

Addiction1418/5358

 

Progress Bar76%

 

That's exactly what I am trying to say. Hook up a Macintosh to a domain hosted by a Windws Server with active directory and have some sort of threat get into that network and you'll see what I mean.

__________________

Mi Familia
Formerly known as El Subestimado
Mi ma'i, mi amor de mi vida: SpicedSugar
Mis hijos: Butterfingered (missing)
Mi hermanita: Dancesintheran, my brother-in-law: Edge_Of_Insanity
Mi Primita: Keena

Swift19

Experienced Toaster (24)

Activity124/581

 

Addiction238/3100

 

Progress Bar26%

 

i know it has nothing to do with the platforms "superiority" or "inferiority". my comment at the end was more directed at the diehard Mac fans (who do not listen to reason) of which i'm sure there are plenty on this site and elsewhere.

__________________
Proud Member of Naked Toasties Club

eDgE oF iNsAnItY

The Better of Most (39)

Activity721/969

 

Addiction808/5062

 

Progress Bar75%

 

I know you weren't saying that. I was pretty much just paraphrasing what El Sub had said...

So, QuickTime is now a browser?? I realize they were talking about vulnerabilities, but it's still like comparing apples to lugnuts to me...

__________________

Arcángel

At Home on the Toast (48)

Activity1553/1553

 

Addiction1418/5358

 

Progress Bar76%

 

Not exactly. Think about it. Internet Explorer is as integral to Microsoft Windows as Quicktime is to Mac.

QuickTime has been an integral part of MAc OS ever since system 6 if I'm not mistaken. It shows up in the xtensions folder on every version of Mac OS, which was way before QT was molded into the Win32 executible that it is now in an effort to begin to bridge the gap between Macintosh and Windows. One of those efforts came in more recent versions of QuickTime which allowed users of Mac OS version 8 and upwards to play MP3, Dolby AAC and other file formats within the same player, without having to download a seperate or third party application extension.

Internet Explorer has been a part of the Windows operating system ever since it's conception in July of 1995, which was the date of the first release of Windows 95, Microsoft's first operating system which included built in support for dialup networking PPP, SLIP, and TCP/IP. However, it was only after popular demand that they threw in IE as part of the Microsoft Plus! Internet Jumpstart Kit. In fact, Windows 98 and all versions afterwards upto Windows XP Service Pack 2 replaced their old File Manager (winfile.exe in Windows 3.1, 95 and NT) with a watered down version of it and called it Windows Explorer and continued that even up to the release of Internet Explorer 6 Service Pack 2 and rught up to the beta of Windows Internet Explorer 7. A copy of the old version of Internet Explorer still remains on the system for users who frequent FTP servers and are accustomed to actually seeing icons within an Explorer window rather than navigating links like versions of Netscape Navigator, Opera, and Mozilla.

The differences between these two applications are uncanny in their purpose as one decodes and encodes audio and video while another looks far, parses and allows acccess to any information available off of the Internet but, ever since web browsing capabilities have been added so that users of QT can browse for movie trailers and what not, more and more of these vulnerabilities will appear.

In this case, I would have to say that neither technology is superior but, in terms of source code, I would have to agree with these researchers when they question Apple's reviewing technique.

When any flagship technology comes under filre, be it Apple's QuickTime, Microsoft's Internet Explorer, Mozilla's Firefox, it's only right to say that these respective companies will definitely come under fire. Operating Systems with UNIX backbones or distributions of Linux (be it commercial or mainstream) are of definitely no exception.

Cited from:
Windows History: Internet Explorer History
QuickTime - Wikipedia, the free encyclopedia
PC World - The Mac Skeptic: Straight Talk on Mac Security Risks

For more info:
SANS Institute - SANS Top-20 2007 Security Risks (2007 Annual Update)

__________________

Mi Familia
Formerly known as El Subestimado
Mi ma'i, mi amor de mi vida: SpicedSugar
Mis hijos: Butterfingered (missing)
Mi hermanita: Dancesintheran, my brother-in-law: Edge_Of_Insanity
Mi Primita: Keena