QuickTime + Firefox = Danger

**Glaswegian** · 09-14-2007, 02:36 PM

Mozilla is scrambling to fix a vulnerability related to the Firefox browser that poses a serious danger for users who also have Apple's QuickTime installed.

According to Petko Petkov, a UK-based web application penetration tester, the current version of QuickTime contains a flaw in its Media Link (.qtl file formats) function. Any file with a QuickTime-supported extension - there are more than 60 - will be parsed by Apple's media player. However, because it fails to sanitise the XML content, an attack can sneak links to malicious JavaScript into the file, and get QuickTime to run it.

http://www.techworld.com/security/ne...S&NewsID=10078

**Jack.Sparrow** · 09-14-2007, 03:15 PM

Thanks for the leg-up

~~jaz_martin~~ · 09-14-2007, 04:23 PM

Good Job keeping us up-to-date.

09-14-2007, 02:36 PM	#1 (permalink)
Glaswegian Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic Join Date: Sep 2005 Location: Glasgow Posts: 25,439 OS: Win XP Pro SP3 / Win 7 Pro My System Blog Entries: 10	QuickTime + Firefox = Danger Mozilla is scrambling to fix a vulnerability related to the Firefox browser that poses a serious danger for users who also have Apple's QuickTime installed. According to Petko Petkov, a UK-based web application penetration tester, the current version of QuickTime contains a flaw in its Media Link (.qtl file formats) function. Any file with a QuickTime-supported extension - there are more than 60 - will be parsed by Apple's media player. However, because it fails to sanitise the XML content, an attack can sneak links to malicious JavaScript into the file, and get QuickTime to run it. http://www.techworld.com/security/ne...S&NewsID=10078 __________________ Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. PC Safety & Security::PC running a bit slow?::Donate::Photographers Corner

09-14-2007, 03:15 PM	#2 (permalink)
Jack.Sparrow Resident Pirate Join Date: Jan 2007 Location: Qld, Aus Posts: 17,867 OS: XP SP3/Vista SP1 My System Blog Entries: 6	Re: QuickTime + Firefox = Danger Thanks for the leg-up __________________ //PC Wizard//Speedfan//Can you run it?//Posting Screenshots//Posting System Specs//Donations//

09-14-2007, 04:23 PM	#3 (permalink)
~~jaz_martin~~ Register user Join Date: Aug 2007 Location: Chicago/Fortaleza Brazil Posts: 140 OS: windows xp	Re: QuickTime + Firefox = Danger Good Job keeping us up-to-date.