From alerts@us-cert.gov Wed Jan 11 17:29:14 2006
From: US-CERT Alerts <alerts@us-cert.gov>
To: alerts@us-cert.gov
Date: Wed, 11 Jan 2006 17:22:38 -0500
Subject: US-CERT Cyber Security Alert SA06-011A -- Apple QuickTime Vulnerabilities 


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



                        National Cyber Alert System

                      Cyber Security Alert SA06-011A


Apple QuickTime Vulnerabilities

   Original release date: January 11, 2006
   Last revised: --
   Source: US-CERT


Systems Affected

   Apple QuickTime for

     * Apple Mac OS X
     * Microsoft Windows XP
     * Microsoft Windows 2000


Overview

     Apple has released Apple QuickTime 7.0.4 to correct several
     vulnerabilities. These vulnerabilities could allow an attacker to
     gain access to your computer.


Solution

Install an Update

     OS X users should use the Mac OS X Software Update feature to
     download and install Apple QuickTime 7.0.4. Consider scheduling
     Software Update to check for updates automatically (this option is
     enabled by default).

     Microsoft Windows users should upgrade to Apple QuickTime 7.0.4.


Description

     QuickTime prior to version 7.0.4 has multiple image and media file
     handling vulnerabilities that could allow an attacker to run
     malicious programs on your computer. Upgrading to Apple QuickTime
     version 7.0.4 will correct these vulnerabilities.

     For more technical information, see US-CERT Technical Alert
     TA06-011A and the Apple QuickTime Security Update.


References

     * Apple QuickTime 7.0.4 -
       <http://www.apple.com/support/downloads/quicktime704.html>

     * Security content of QuickTime 7.0.4 -
       <http://docs.info.apple.com/article.html?artnum=303101>

     * US-CERT Technical Alert TA06-011A -
       <http://www.us-cert.gov/cas/techalerts/TA06-011A.html>

     * US-CERT Vulnerability Note -
       <http://www.kb.cert.org/vuls/id/115729>

     * US-CERT Vulnerability Note -
       <http://www.kb.cert.org/vuls/id/150753>

     * US-CERT Vulnerability Note -
       <http://www.kb.cert.org/vuls/id/629845>

     * US-CERT Vulnerability Note -
       <http://www.kb.cert.org/vuls/id/921193>

     * US-CERT Vulnerability Note -
       <http://www.kb.cert.org/vuls/id/913449>

     * Mac OS X: Updating your software -
       <http://docs.info.apple.com/article.html?artnum=106704>


 ____________________________________________________________________

   The most recent version of this document can be found at:

     <http://www.us-cert.gov/cas/alerts/SA06-011A.html>
 ____________________________________________________________________

   Feedback can be directed to US-CERT Technical Staff. Please send
   email to <cert@cert.org> with "SA06-011A Feedback VU#913449" in the
   subject.
 ____________________________________________________________________

   For instructions on subscribing to or unsubscribing from this
   mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
 ____________________________________________________________________

   Produced 2006 by US-CERT, a government organization.

   Terms of use:

     <http://www.us-cert.gov/legal.html>
 ____________________________________________________________________


Revision History

   Jan 11, 2006: Initial release


    

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iQEVAwUBQ8WEsn0pj593lg50AQJvFAgAz1X/84ZOVkyJLHAiCD9jlLqxZyadmTgv
GzB1cAlUAKmGFG9xqmqetlqyWK6vdtQx7lNXo4oZLEbKCI/jXfYXa4Ha2pIQz12B
7Tm5iLC6whS7RqQjlqinq/uEhj3LBnDtbM8VXLfMXMqROZxARK2bKVibRoj6IaLU
dTE6OL7XCJcKs8GcFKUOjseRLMc4QlF+zdefxmN/m+YJStQmWbW6yjYYiHWdaSo0
25KeRkp7Vpf5Uw0+R7g1iu9oB3SDvv8vG8RDflFriZhqj+elY0UQ9tYE39nWjY9J
JlUrIr+odzrdnKBo9flKYdMmIUFzjQDOVw0+cdBcbJGgcOfIyKDRdQ==
=Zz+Y
-----END PGP SIGNATURE-----