Web Security News

Apple fixes security bug identified in Mac hacker book

Tuesday, June 2, 2009

Apple released patches Monday for 10 security holes in QuickTime 7.6.2 for Windows 7 and Mac OS X and one patch for a flaw in iTunes 8.2. One of the flaws was previously disclosed in a hacker's manual published in March.

All of the critical vulnerabilities were described as allowing "arbitrary code execution," which if exploited could result in a hacker taking control of an infected PC or Mac. Apple does not rank its fixes by severity of vulnerability as do other software companies.

Security experts said the QuickTime vulnerabilities were primarily file format processing bugs, but included one flaw that was identified in a book released in March called The Mac Hacker's Handbook, written by IT security pros Charlie Miller and Dino Tai.

Miller said he put instructions in the book that would allow a reader to find the bug, although he did not show proof of concept, according to PC World.

"If you followed all the steps [in the book] you would find ... the bug," Miller told PC World yesterday. "I didn't show the bug, but I gave the recipe for how to find it."

The bug involves a flaw in the way QuickTime reads files that are compressed using the JPEG 2000 (JP2) standard.

Miller, who won a hacking contest at the Pwn2Own conference sponsored by Apple, gave the exploit code for the JP2 flaw to Apple's security team after he announced that it was partially revealed in his book, according to PC World.
ADNFCR-1765-ID-19198406-ADNFCR

Related News:

Mac OS X malware game Lose-Lose deletes files - 11.5.2009
A graduate student has written a game for Mac OS X that resembles the classic video game Space Invaders, but Mac users should not download the game if they don't want to have it randomly delete files.

Adobe issues critical security update for Shockwave Player - 11.5.2009
Adobe Systems yesterday released a critical update for all versions of Shockwave Player and recommends that users upgrade to version 11.5.2.602 to protect against cyber attacks exploiting the vulnerability.

Microsoft Security Essentials detects malware that kills Windows XP - 11.5.2009
A new Trojan malware detected by Microsoft Security Essentials as Win32/Daonol steals credential information and redirects web traffic, Microsoft said on its malware protection blog.

FBI warns of malware targeting corporate bank accounts - 11.4.2009
A new report from the FBI cyber crime division said hackers have attempted theft of $100 million from online bank accounts, using sophisticated malware that steals bank account passwords.

Microsoft issues Internet Explorer security update - 11.3.2009
Microsoft on Monday issued a security bulletin that updates a previous patch for Internet Explorer to resolve two issues. The IE bug only affects users who already applied the earlier patch.
View Related Resources
Or
Watch an Online Demo
Or
Have us call you now