Luigi Auriemma has reported a vulnerability in Apple QuickTime, which potentially can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error when handling RTSP replies and can be exploited to cause a heap-based buffer overflow via e.g. sending a specially crafted reply containing an overly-long "Reason-Phrase".

Successful exploitation may allow execution of arbitrary code, but requires that the user is e.g. tricked into opening a malicious QTL file or visiting a malicious web site.

The vulnerability is reported in version 7.3.1.70. Other versions may also be affected.

Solution
Update to QuickTime 7.4.1.
Further details available to Secunia VIM customers

Provided and/or discovered by
Luigi Auriemma

Changelog
Further details available to Secunia VIM customers

Original Advisory
Apple:
http://docs.info.apple.com/article.html?artnum=307407

Luigi Auriemma:
http://aluigi.altervista.org/adv/quicktimebof-adv.txt

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers