Thoughtful, detailed coverage of the Mac, iPhone, and iPad, plus the TidBITS Content Network for Apple consultants.

QuickTime 7.4 Improves Security, but Not Enough

Apple updated its media workhorse QuickTime to version 7.4 last week, fixing bugs and adding support for new iTunes features such as downloadable movie rentals. But the more important news is that this version squashes a handful of security holes that could allow remote attacks. However, a serious vulnerability discovered shortly before Macworld Expo demonstrates that Apple's engineers need to remain hard at work.

The QuickTime 7.4 update is available for Leopard (a 55 MB download), Tiger (a 51 MB download), Panther (a 50 MB download), and Windows (both XP and Vista, a 22 MB download).

The most recent exploit, not addressed in QuickTime 7.4, takes advantage of a hole in QuickTime's RTSP (Real Time Streaming Protocol) that could open a computer to a denial-of-service attack or possible remote code execution. (RTSP is not a new target; see "Protect Yourself from the QuickTime RTSP Vulnerability," 2007-09-07.) Because QuickTime is the underlying technology of iTunes, Macs and Windows computers running QuickTime are vulnerable. Anyone who uses iTunes or owns an iPod should update.

 

TextExpander: Communicate smarter. Accuracy and consistency
wherever you type. Insert “snippets” of text from a repository of
boilerplate, emails and other text. Seamless sharing between you
and your team on Mac, Windows, and iOS <http://smle.us/newte-tb>