Free Republic
Browse · Search
General/Chat
Topics · Post Article

Skip to comments.

QuickTime update patches Java flaw (Mac security loophole closed!)
MacCentral ^ | 5/1/2007 | Peter Cohen

Posted on 05/01/2007 3:59:17 PM PDT by Yossarian

Apple on Tuesday offered QuickTime 7.1.6, an update to its core multimedia software for Mac OS X and Windows. Among the issues adjusted in this release is a fix for an exploit in QuickTime for Java that first came to light at a security conference two weeks ago.

QuickTime 7.1.6 addresses numerous bug fixes and includes support for Final Cut Studio 2, and timecode and closed captioning support in QuickTime Player. Apple recommends the update for all QuickTime 7 users. It is available for download from Apple’s Web site or from the Software Update system preference.

“An implementation issue exists in QuickTime for Java, which may allow reading or writing out of the bounds of the allocated heap. By enticing a user to visit a web page containing a maliciously-crafted Java applet, an attacker can trigger the issue which may lead to arbitrary code execution,” reads Apple’s technical note announcing the update. “This update addresses the issue by performing additional bounds checking when creating QTPointerRef objects. Credit to Dino Dai Zovi working with TippingPoint and the Zero Day Initiative for reporting this issue.”

The exploit with QuickTime for Java was first reported as a Mac OS X issue as it was the winner in a $10,000 price to break into a MacBook Pro set up at a recent security conference. It was later revealed as a cross-platform security flaw that affects Mac and Windows users alike. Security experts opined that it was inevitable the Mac would suffer such issues. The exploit’s discoverer, Dino Dai Zovi, said he’s been using Mac OS X from the start, though said in a recent interview that he felt Microsoft’s new Vista operating system was more secure than Mac OS X.


TOPICS: Computers/Internet
KEYWORDS: hacker; macosx; tippingpoint
Navigation: use the links below to view more comments.
first 1-2021 next last
Time to run "Software Update…" under the Apple Menu, Mac folks!
1 posted on 05/01/2007 3:59:20 PM PDT by Yossarian
[ Post Reply | Private Reply | View Replies]

To: Yossarian

Hmm, I didn’t know Mac’s had security flaws.


2 posted on 05/01/2007 4:00:49 PM PDT by Rodney King (No, we can't all just get along.)
[ Post Reply | Private Reply | To 1 | View Replies]

To: Swordmaker

Ping.


3 posted on 05/01/2007 4:00:55 PM PDT by verum ago (The Iranian Space Agency: set phasers to jihad!)
[ Post Reply | Private Reply | To 1 | View Replies]

To: Swordmaker; CheneyChick; EmmaPeel

Machead ping!


4 posted on 05/01/2007 4:01:26 PM PDT by Yossarian (Everyday, somewhere on the globe, somebody is pushing the frontier of stupidity...)
[ Post Reply | Private Reply | To 1 | View Replies]

To: Rodney King
Hmm, I didn’t know Mac’s had security flaws.

Hmm, I didn't think you could generate as many useless posts as you have.

5 posted on 05/01/2007 4:02:39 PM PDT by Yossarian (Everyday, somewhere on the globe, somebody is pushing the frontier of stupidity...)
[ Post Reply | Private Reply | To 2 | View Replies]

To: Rodney King

LOL! Stand by for the onslaught!


6 posted on 05/01/2007 4:03:02 PM PDT by doc1019 (Fred Thompson '08)
[ Post Reply | Private Reply | To 2 | View Replies]

To: Yossarian

45 megabytes later...


7 posted on 05/01/2007 4:06:06 PM PDT by kerryusama04 (John 19:31)
[ Post Reply | Private Reply | To 1 | View Replies]

To: kerryusama04; Swordmaker; All
Some of you, if you are running 10.3.9, or OS X Server 10.4.X, will also be prompted by Software Update to install "Security Update 2007-004 v1.1".

OK, Software update just finished for me... time to restart... see y'all in a bit!

8 posted on 05/01/2007 4:10:19 PM PDT by Yossarian (Everyday, somewhere on the globe, somebody is pushing the frontier of stupidity...)
[ Post Reply | Private Reply | To 7 | View Replies]

To: doc1019; Rodney King; All
OK, I'm back - a trouble-free update.

You two, as well as any other PC users, should know that this Quicktime update is for the PC as well. (Ah, unless you're under Linux....)

Here is the direct link to the update page.

9 posted on 05/01/2007 4:23:52 PM PDT by Yossarian (Everyday, somewhere on the globe, somebody is pushing the frontier of stupidity...)
[ Post Reply | Private Reply | To 6 | View Replies]

To: Yossarian

Thanks, will check it out.


10 posted on 05/01/2007 4:28:13 PM PDT by doc1019 (Fred Thompson '08)
[ Post Reply | Private Reply | To 9 | View Replies]

To: 1234; 50mm; 6SJ7; Abundy; Action-America; af_vet_rr; afnamvet; akatel; Alexander Rubin; Amadeo; ...
Mac Software update... Hole patched... PING!

If you want on or off the Mac Ping List, Freepmail me.

11 posted on 05/01/2007 8:26:56 PM PDT by Swordmaker (Remember, the proper pronunciation of IE is "AAAAIIIIIEEEEEEE)
[ Post Reply | Private Reply | To 1 | View Replies]

To: Yossarian

Thanks for the heads up...


12 posted on 05/01/2007 8:28:16 PM PDT by Swordmaker (Remember, the proper pronunciation of IE is "AAAAIIIIIEEEEEEE)
[ Post Reply | Private Reply | To 1 | View Replies]

To: Yossarian

Technically, he’s only generated two — the one seen above, and word for word in a number of other topics, and the other one, seen word for word in a number of other topics, where he says everyone who uses a Mac is gay.


13 posted on 05/01/2007 10:23:45 PM PDT by SunkenCiv (I last updated my profile on Saturday, April 28, 2007. https://secure.freerepublic.com/donate/)
[ Post Reply | Private Reply | To 5 | View Replies]

To: SunkenCiv
Technically, he’s only generated two — the one seen above, and word for word in a number of other topics, and the other one, seen word for word in a number of other topics, where he says everyone who uses a Mac is gay.

You'd think they'd eventually look for some new material.

  BTW, that article on Gilgamesh this morning was too cool.
 

14 posted on 05/02/2007 7:11:07 AM PDT by zeugma (MS Vista has detected your mouse has moved, Cancel or Allow?)
[ Post Reply | Private Reply | To 13 | View Replies]

To: zeugma

:’) Epic, even. ;’)


15 posted on 05/02/2007 7:18:07 AM PDT by SunkenCiv (I last updated my profile on Saturday, April 28, 2007. https://secure.freerepublic.com/donate/)
[ Post Reply | Private Reply | To 14 | View Replies]

To: Yossarian
Credit to Dino Dai Zovi working with TippingPoint and the Zero Day Initiative for reporting this issue

So much for Apple suing, or being malicious towards, those who expose security flaws.

16 posted on 05/02/2007 7:33:34 AM PDT by antiRepublicrat
[ Post Reply | Private Reply | To 1 | View Replies]

To: Yossarian; All

HELP! Please reply in words an eight-year-old can understand. LOL!

I have OS10.4.9. I’ve had Mac for six years, and I am STILL mentally confused by all the years I’ve spent on PC. (UGH) I use my computer ONLY at home, and I have no one to advise me.

I don’t do anything that requires final cut. Is that for users who do movies?

Can I ignore the latest software update and still use my old, original copy of Quick Time? Or will it affect the usual times Quick Time (not Pro) uses?

Does this question even make sense?

The ONLY problem with Mac is that if you use it at home there is NO ONE to help you through the complicated geek talk. You people are so far ahead of us commoners.

I am eager to learn.


17 posted on 05/02/2007 9:56:12 AM PDT by kitkat
[ Post Reply | Private Reply | To 1 | View Replies]

To: kitkat

Keep it simple:

1. Select the “Software Update…” menu item under the blue Apple menu (available from any application);
2. The Software Update application will launch, and automatically check for updates; and
3. When it asks if you want an update installed, click “OK”.

That’s it! But YES, install this update - it is very, very important, even for basic web surfing.


18 posted on 05/02/2007 10:31:56 AM PDT by Yossarian (Everyday, somewhere on the globe, somebody is pushing the frontier of stupidity...)
[ Post Reply | Private Reply | To 17 | View Replies]

To: Yossarian

***But YES, install this update - it is very, very important, even for basic web surfing.***

THAT’S IT! That’s exactly what I needed to know, but didn’t know how to ask it. THANK YOU.

And NOW, if I may ask for a bit more of your valuable time, what the heck does the following mean? And does it apply to me if I don’t do anything more complicated than download someone else’s Quick Time stuff?

“Important Notice to QuickTime Pro Users?QuickTime 7 will disable the QuickTime Pro functionality in prior versions of QuickTime, such as QuickTime 5 or QuickTime 6. If you proceed with this installation, you must purchase a new QuickTime 7 Pro key to regain QuickTime Pro functionality. After installation, visit www.apple.com/quicktime to purchase a QuickTime 7 Pro key.”

Sigh. I feel SO stupid.


19 posted on 05/02/2007 11:15:47 AM PDT by kitkat
[ Post Reply | Private Reply | To 18 | View Replies]

To: kitkat
Short answer: don't worry about it.

Long answer: QuickTime is a software technology that allows you to view, listen to, and create multimedia. It is comprised of

  1. an underlying software engine that you never see;
  2. "QuickTime Player", a little application that lets you play movies outside of the web browser; and
  3. the QuickTime web plug-in, so you can play movies inside your web browser.

If you pay Apple $15, they give you a "QuickTime Pro" key:

  1. The underlying software engine doesn't change;
  2. "QuickTime Player" now lets you create and edit movies, and play them back "full screen"; and
  3. The QuickTime web plug-in now allows you to save movies from the web onto your hard drive, if the website condones this (some don't).

Every time Apple makes a major release of QuickTime, like from version 5 to 6, or from version 6 to 7 (current), they make QuickTime Pro users buy a new key (cha-ching!). These major releases happen about once every two or three years. Minor releases, such as the one done yesterday from QT 7.1.5 to 7.1.6, don't require repurchasing of a key.

20 posted on 05/02/2007 11:41:29 AM PDT by Yossarian (Everyday, somewhere on the globe, somebody is pushing the frontier of stupidity...)
[ Post Reply | Private Reply | To 19 | View Replies]


Navigation: use the links below to view more comments.
first 1-2021 next last

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.

Free Republic
Browse · Search
General/Chat
Topics · Post Article

FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson