LMH has discovered a vulnerability in Apple Quicktime, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error when handling RTSP URLs. This can be exploited to cause a stack-based buffer overflow via a specially crafted QTL file with an overly long (more than 256 bytes) "src" parameter (e.g. "rtsp://[any character]:[>256 bytes]").

Successful exploitation allows execution of arbitrary code and requires that the user is e.g. tricked into opening a malicious QTL file or visiting a malicious web site.

The vulnerability is confirmed in version 7.1.3.100 (Windows version) and reportedly affects both Microsoft Windows and Mac OS X versions.

Solution
Apply Security Update 2007-001.
Further details available to Secunia VIM customers

Provided and/or discovered by
LMH

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://projects.info-pull.com/moab/MOAB-01-01-2007.html

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers