|
12.03.07
Security Flaw
Hits SecondLife
 By Dan
Morrill
Linden
Labs is advising users that the not fixed security flaw with
QuickTime is influencing their users.
While this information is a little old, apple has still not patched the flaw
that was released as an exploit on the 27th of November.
It would be simple enough to deinstall QuickTime
until a patch comes out, but then every website that uses QuickTime to share
video or advertising will suddenly have a whole.
The problem is that there is no patch fix posted to date.
We were alerted a short time ago that a QuickTime exploit has
been discovered which may allow an attacker to crash or exploit the Second
Life viewer.
The Second Life viewer uses Apple QuickTime to play videos and streaming
media. This exploit affects QuickTime usage on every platform that uses it,
and to date, Apple has not released a fix for the exploit. Second Life Blog
This is what makes it interesting, and why apple needs to develop and issue
a patch sooner rather than later. As the dependency tree on this one would
cause people to abandon the software until it can be fully patched.
This means that users will move onto other media formats, and might not cross
back to apple formats when the issue has been patched.
The attack is a simple buffer overflow that crashes the browser or stand alone
player. Symantec reports
that it does not carry any real malware other than crashing the application
at the time of posting.
This does not mean that others will not be modifying the public code to do
more evil things along the way.
Given that this is now five days old, there are probably POC code out there
that carries a more traditional malware package.
In the longer run, the whole apple video system is probably going to see a
drop off in adoption until the patch is released.
Comments
About the Author:
Dan Morrill has been in the information security field for 18 years, both civilian
and military, and is currently working on his Doctor of Management.
Dan shares his insights on the important security issues of today
through his blog, Managing
Intellectual Property & IT Security, and is an active participant
in the ITtoolbox blogging
community. |
