QuickTime RTSP buffer overflow vuln

FYI…

QuickTime RTSP buffer overflow
> http://www.kb.cert.org/vuls/id/442497
Last Updated: 01/02/2007
"…QuickTime may allow remote arbitrary code to be executed via a long src parameter in RTSP URL strings… since QuickTime is a component of Apple iTunes, iTunes installations are also affected by this vulnerability. We are aware of publicly available proof-of-concept code that exploits this vulnerability…"

- http://forums.tomcoyote.org/index.php?act=…st&p=341698

FYI…

- http://research.eeye.com/html/alerts/zeroday/index.html
Apple QuickTime RTSP URL Buffer Overflow
Vendor: Apple
Application: QuickTime
Severity: High
Date Disclosed: Jan 1, 2007
Days of Exposure: 10

- http://secunia.com/advisories/23540/
Critical: Highly critical
Impact: System access
Where: From remote
Solution Status: Unpatched

.

FYI…

> http://www.kb.cert.org/vuls/id/442497
Last Updated: 01/23/2007 ~ "…Apple has issued an update to this issue. See Apple Security Update 2007-001. This update appears to apply only to systems running Mac OS X. It is -not- clear that an update for Windows systems is available as of 2007-01-23…"

:wtf:

FYI…

- http://www.kb.cert.org/vuls/id/442497
1.24.2007 ~ "Solution: Apply Update: This issue is addressed in Apple Security Update 2007-001…
An update for Microsoft Windows XP and 2000 systems is available via the Apple Software Update* application installed with QuickTime 7.1.3…"
(NOTE: See c:\program files\apple software update\softwareupdate.exe to start the program.)

How to repair Software Update for Windows
* http://docs.info.apple.com/article.html?artnum=304264

How to tell if Software Update for Windows is working correctly when no updates are available
- http://docs.info.apple.com/article.html?artnum=304263 …