Zero-day exploit for QuickTime in the wild
The Unofficial Apple Weblog (TUAW) —
Filed under: Multimedia, iTunes, Security A hacker who found a vulnerability in QuickTime said he posted the attack code online after Apple ignored him for a month.
The code exploits a flaw in QuickTime that causes a crash when a unusually-long parameter is passed along with a movie file. While it's not demonstrated, the hacker claims that "code execution may be possible."
With Leopard, address space randomization makes it more difficult to execute code in memory spaces left after a crash. Earlier operating systems (like Tiger and ...
‘Macsimum Recommended Reading’ for Sept. 18
Macsimum News —
... “Zero-Day Exploit Code For Apple iTunes, QuickTime Posted: The vulnerability in Apple’s newly patched software is said to crash any browser with the QuickTime plug-in.”— InformationWeek “Apple to show off Aperture and Final Cut Studio in Manchester: Beginning in the Manchester on October 7, Apple will take Aperture 2—the company’s photo editing and management software—and the Final Cut Studio video post production suite on tour around Europe from the UK to Finland. Apple is offering a series of free, in-depth seminars that features demonstrations of the software”— ...
Daily Apple: iPhone Development, QuickTime Vulnerability, Turtlenecks, & Android
TheAppleBlog —
... Zero-Day Exploit Code For Quicktime Posted - Supposedly Apple has ignored a submitted vulnerability and in turn the person who found the vulnerability has published it online. ...

