QuickTime opens up a security leak in Firefox

ronjor · Sep 13, 2007

In a blog entry, the security specialist Petko Petkov (pdp) has drawn attention to a vulnerability via which attackers using specially crafted QuickTime media files can execute any JavaScript code in Firefox with maximum rights, or run programs on the computer. For this to work, Firefox has to be set up as the default browser and Apple's QuickTime (or QuickTime Alternative, according to some reports) has to be installed on the computer – hardly an unusual configuration.
Click to expand...

Story

lucas1985 · Sep 13, 2007

Until a patch is delivered, use NoScript to control plug-ins

Dogbiscuit · Sep 13, 2007

"0DAY: QuickTime pwns Firefox"

pdp responds:

Simon, yes it is not Firefox specific. It works for IE as well, although the impact is less critical I must say. This is due to the tightened security policies IE implements for local zone scripts.
Click to expand...

Rasheed187 · Sep 22, 2007

I just wonder if this is serious stuff? On my system it did manage to terminate Skype. And there is also some unrelated exploit for Win Media files, I´m not sure what to think of it.

http://aviv.raffon.net/2007/09/14/UsingQuickTimeToAutomateXASAttacks.aspx
http://www.gnucitizen.org/blog/backdooring-windows-media-files

Log in or Sign up

QuickTime opens up a security leak in Firefox

ronjor Global Moderator

lucas1985 Retired Moderator

Dogbiscuit Guest

Rasheed187 Registered Member

Log in or Sign up

QuickTime opens up a security leak in Firefox

ronjor Global Moderator

lucas1985 Retired Moderator

Dogbiscuit Guest

Rasheed187 Registered Member

Useful Searches