New QuickTime Flaw Bypasses ASLR, DEP 162
Trailrunner7 writes "A Spanish security researcher has discovered a new vulnerability in Apple's QuickTime software that can be used to bypass both ASLR and DEP on current versions of Windows and give an attacker control of a remote PC. The flaw apparently results from a parameter from an older version of QuickTime that was left in the code by mistake. It was discovered by Ruben Santamarta of Wintercore, who said the vulnerability can be exploited remotely via a malicious Web site. On a machine running Internet Explorer on Windows 7, Vista or XP with QuickTime 7.x or 6.x installed, the problem can be exploited by using a heap-spraying technique. In his explanation of the details of the vulnerability and the exploit for it, Santamarta said he believes the parameter at the heart of the problem simply was not cleared out of older versions of the QuickTime code. 'The QuickTime plugin is widely installed and exploitable through IE; ASLR and DEP are not effective in this case and we will likely see this in the wild,' said HD Moore, founder of the Metasploit Project."
Re:ew quicktime? (Score:4, Funny)
Closed source. .....
Apple's evil.
Wait.
Microsoft's evil.
Wait.
It's Google.
No. Apple.
No. Microsoft.
Damn you evil closed source! You have me so confused as to who to hate
Re:Quick! (Score:4, Funny)
Or free software when you've already paid.
Re:ew quicktime? (Score:1, Funny)
People still use that garbage? That's like installing real player.
It's quite green to use garbage. And yes I'm a real player, and you can install me for a small fee.
Full advantage? (Score:1, Funny)
If you own an iPhone, iPod, or iPad, it's fairly hard to get full advantage of your money.
Re:Steve Jobs says (Score:2, Funny)
This is why people love Apple! (Score:1, Funny)
People love Apple for this stuff, though.
No more screwing around bypassing ASLR or DEP, even the exploit code Just Works.
Re:Full advantage? (Score:1, Funny)
open cmd.exe as admin (right click is your friend) and type this:
Opening command prompts and typing weird commands? Nobody's going to remember this crap. Windows has a long way to go before it's ready for the desktop!
Re:ew quicktime? (Score:1, Funny)
I certainly hope all of the blackhats will take such a responsible stance and own up to any such flaws in their malware...