Posted on 01/03/2007 11:04:31 AM PST by newgeezer
The Month of Apple Bugs project kicked off Monday by posting a zero-day vulnerability in Apple's QuickTime media player. It also posted an exploit that could be used by attackers to compromise, hijack, or infect computers running either Windows or Mac OS X.
The Month of Apple Bugs (MoAB), which will announce a new security vulnerability in Apple's operating system or other Mac OS X software each day in January, is a follow-on to November's "Month of Kernel Bugs" campaign, and is co-hosted by that project's poster, a hacker who goes by the initials "LMH," and a partner, Kevin Finisterre, a researcher who has posted numerous Mac vulnerabilities and analyses on his own site.
The debut vulnerability is in QuickTime 7's parsing of RTSP (RealTime Streaming Protocol); the protocol is used to transmit streaming audio, video, and 3-D animation over the Web. Users duped into clicking on an overlong rtsp:// link could find their PCs or Macs compromised. It also may be possible to automatically trigger an attack simply by enticing users to a malicious Web site.
"Exploitation of this issue is trivial," said LMH in the vulnerability's write-up on the MoAB Web site. The associated exploit code has been tested on Mac OS X running on Intel-based systems, and works against QuickTime 7.1.3, the current version of the player, LMH and Finisterre said.
Other security researchers rang alarms Tuesday. Danish vulnerability tracker Secunia, for example, pegged the bug as "highly critical," the second-from-the-top threat in its five-step score, and Symantec alerted customers of its DeepSight threat network of the vulnerability.
An Apple spokesman declined to confirm the vulnerability, or, if it was legitimate, when the flaw might be fixed. In an e-mail, he said that "Apple takes security very seriously and has a great track record of addressing potential vulnerabilities before they can affect users. We always welcome feedback on how to improve security on the Mac."
LMH, who didn't immediately reply to several questions sent via e-mail, said on the MoAB site that Apple's Mac OS X operating system was chosen as the target for the month of vulnerabilities because "we like to play with OS X, we enjoy hate e-mail, and it's not as crowded as (random software vendor), yet. Thus, it's really comfortable for research and there's so much to be worked out."
He also said that Apple -- and other vendors whose Mac OS X applications might be the focus of a bug posted during the month's run -- would not be notified in most cases before the information went live, and dismissed that practice. "The point is releasing them without vendor notification. The problem with so-called 'responsible disclosure' is that for some people, it means keeping others on hold for insane amounts of time, even when the fix should be trivial. And the reward (automated responses and euphemism-heavy advisories) doesn't pay off in the end."
LMH, Finisterre, and commercial security vendors recommended that users cripple QuickTime's ability to process rtsp:// links. In Windows, launch QuickTime, select Edit|Preferences|QuickTime Preferences, click the File Types tab, expand Streaming, and clear the box marked "RTSP stream descriptor." In Mac OS X, select System Preferences|QuickTime|Advanced|MIME Settings|Streaming|Streaming Movies and clear the "RTSP stream descriptor" box.
Apple's QuickTime was last in the news during December, when a bug in the player was exploited by fraudsters on MySpace. That vulnerability remains unpatched.
LMH expects to see more QuickTime attacks now that his newest flaw has gone public. He said, "It's a matter of time to see this getting abused in the wild."
ANOTHER LIE
they bought a TCP/IP stack from Spider Systems
I know, but you just knowingly and puposefully lied claiming they "lifted it". More proof you're willing to lie endlessly even when facts are present that expose them, as if there weren't enough already LOL. Keep going, you've already admitted you lie quote "for fun", while I have my fun exposing liars for being liars.
It obviously has a lot more basis than your claim they couldn't be criminal, that you've been making for months LOL.
Being shown for the fool and fraud you are is really burning you up, isn't it?
ROFLMAO, you're the one who outright admitted they knowingly and purposefully lied, for months on end, in defense of illegal activity conducted by Russian hackers. Calling me "the fool and the fraud" is obviously just another one of your endless lies, which I'm sure will now continue.
You're putting words in my mouth again. I said you were wrong for calling it criminal because the facts that we have show no activity that would qualify them for criminal prosecution. As I said, you can make up facts that would qualify them, but those weren't in the article. IOW, you call them criminal with no real factual basis, which is -- per your MO -- libel.
you're the one who outright admitted they knowingly and purposefully lied
And you keep denying your proven lies. Who's more honest?
I have my proof. Where is yours to the contrary?
I know, but you just knowingly and puposefully lied claiming they "lifted it".
Trying to take me out of context yet again in order to libel me?
Notice I put "lifted" in quotes, exactly like you did. That's because I don't agree with the connotation of theft that the word "lifted" carries. Read a little further to create the context that you love to so conveniently omit, and you will see where I said that Microsoft's actions were (according to the evidence we have) completely legal.
Unlike you, I don't make up facts. In this case the invented facts would be that Microsoft and/or Spider didn't credit Berkeley in the TCP/IP stack code, which would make it copyright infringement. But the facts aren't there, so I don't claim Microsoft did anything wrong. Innocent until proven guilty, what a concept.
LMAO, obviously I am, since you have already outright admitted you knowingly and purposefully lied, for months, in defense of the Russian hackers' illegal activities. You haven't proven I have ever lied knowingly or purposefully, and most every time you try it just ends up being more of your endless lies, just as we have seen on this thread.
Yet you, in response to hard evidence of your lies, evade and distract with libel and other personal attacks.
LOL of course you don't, as we've seen you admit to knowingly and puposefully lying for months in defense of theives, why would we be surprised you don't think "lifting" can be equated to stealing? The fact that is commonly what it means, especially in the context of transferring location from one party to the next, or the fact dictionary.com lists in its definitions of lifting "to steal or pilfer". Of course we're not surprised you refuse to accept the documented definition, as defending those who "steal or pilfer" the property of others is what you constantly do. It's obviously just another lie you're trying to perpetuate on behalf of theives, just like you've previously admitted to doing.
Back to trying to claim the lies you admitted to knowingly perpetrating for months in defence of illegal activity are my fault again huh. Wonder how long till you accuse me of sex with goats again too LOL.
No, my point is that IT DOESN'T MATTER.
It's a screen name. Geez, get a grip already.
fd--be sure to add this in (going ballistic over somebody's screen name)
Nope, see antiRepublicrat's post on BSD.
I didn't reply this morning because yes, I actually have a life...
"Lies lies lies, got anything else?"
Unlike you, we've actually proved our points. All you do is provide baloney and hope it sticks. And when you see it doesn't, you resort to personal attacks on us.
You're the one who's lying. If what you're saying is true, post the unadulterated smoking guns that prove us wrong. Otherwise, just shut up already.
LOL you're the one suffering from obvious anxiety over your claims you can't defend, not me. He without question chose to use hacker symbology in his username, if you think you can eventually somehow prove it has no possible relationship with hackers you're welcome to keep trying. Saying in all bold "IT DOESN'T MATTER" doesn't work though, LOL.
People who are smart enough to figure these things out, should use their intellect to help their fellow man. Hackers are sociopaths.
What, like claiming the word "lifted" doesn't have a defintion on dictionary.com of "to steal or pilfer"? I'm the one that has repeatedly shown that the technology was bought and paid for, while the liars on display are now down to trying to deny the meaning of the words that define theft.
What, like trying to claim the word "lifted" doesn't have a defintion on dictionary.com of "to steal or pilfer"? I'm the one that has repeatedly shown that the technology was bought and paid for, while the liars on display are now down to trying to deny the meaning of the words that define theft.
no, you're the one going nuts because somebody chose to use 3 instead of e in his screen name.
we're all sick and tired of your bloviating--and how none of us are actually on topic since you popped up here.
You need to get a grip, Iggle. Seriously.
MS and Spider lifted the stack from BSD and failed to give proper credit. All they would have had to do was include
"Copyright (c) 1983 The Regents of the University of California" and they would have been clearly street legal and in compliance with the BSD license. Heck, it even could have been just a comment in the source code.
Instead, they didn't and then passed the code off as their own. That's lifting. Got it?
I need evidence for that. Credit is still there for the other utilities they got from Spider, so why remove the credits in the TCP/IP stack itself?
i searched through the stack and haven't seen anything. until i do, i'm going to have to presume it ain't there.
Are you intentionally dense? Where did I even insinuate my test of you was your fault? Yes, I did it because you were being abusive, but that was still my choice, and mine alone.
However, you lied time and time again when referencing my test of you. You still refuse to admit those lies.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.