Si informa che sono state segnalate dal Cert delle vulnerabilita` dei
\nsistemi Apple Mac e di Quick Time.
\nSi raccomanda di effettuare gli opportuni aggiornamenti.<\/p>\n
Domenica Quartarella
\nServizio Calcolo<\/p>\n
National Cyber Alert System<\/p>\n
Technical Cyber Security Alert TA06-132B<\/p>\n
Apple QuickTime Vulnerabilities<\/p>\n
Original release date: May 12, 2006
\n Last revised: —
\n Source: US-CERT<\/p>\n
Systems Affected<\/p>\n
Apple QuickTime on systems running<\/p>\n
* Apple Mac OS X
\n * Microsoft Windows<\/p>\n
Overview<\/p>\n
Apple QuickTime contains multiple vulnerabilities. Exploitation of
\n these vulnerabilities could allow a remote attacker to execute
\n arbitrary code or cause a denial-of-service condition.<\/p>\n
I. Description<\/p>\n
Apple QuickTime 7.1 resolves multiple vulnerabilities in the way
\n different types of image and media files are handled. An attacker
\n could exploit these vulnerabilities by convincing a user to access
\n a specially crafted image or media file with a vulnerable version
\n of QuickTime. Since QuickTime configures most web browsers to
\n handle QuickTime media files, an attacker could exploit these
\n vulnerabilities using a web page.<\/p>\n
For more information, please refer to the Vulnerability Notes.<\/p>\n
II. Impact<\/p>\n
The impacts of these vulnerabilities could allow an remote,
\n unauthenticated attacker to execute arbitrary code or commands, and
\n cause a denial-of-service condition. For further information,
\n please see the Vulnerability Notes.<\/p>\n
III. Solution<\/p>\n
Upgrade<\/p>\n
Upgrade to QuickTime 7.1. This and other updates for Mac OS X are
\n available via Apple Update.<\/p>\n
Disable QuickTime in your web browser<\/p>\n
An attacker may be able to exploit this vulnerability by persuading
\n a user to access a specially crafted file with a web
\n browser. Disabling QuickTime in your web browser will defend
\n against this attack vector. For more information, refer to the
\n Securing Your Web Browser document.<\/p>\n
Appendix A. References<\/p>\n
* Vulnerability Notes for QuickTime 7.1 – * Securing Your Web Browser – * About the security content of the QuickTime 7.1 Update – * Apple QuickTime 7.1 – * Standalone Apple QuickTime Player – * Mac OS X: Updating your software – ____________________________________________________________________<\/p>\n The most recent version of this document can be found at:<\/p>\n <www.us-cert.gov\/cas\/techalerts\/TA06-132B.html<\/a>> National Cyber Alert System<\/p>\n Technical Cyber Security Alert TA06-132A<\/p>\n Apple Mac Products Affected by Multiple Vulnerabilities<\/p>\n Original release date: May 12, 2006 Systems Affected<\/p>\n * Apple Mac OS X version 10.3.9 (Panther) and version 10.4.6 (Tiger) Previous versions of Mac OS X may also be affected. Please see Apple Overview<\/p>\n Apple has released Security Update 2006-003 to correct multiple I. Description<\/p>\n Apple Security Update 2006-003 resolves a number of vulnerabilities II. Impact<\/p>\n The impacts of these vulnerabilities vary. For information about III. Solution<\/p>\n Install an update<\/p>\n Install Apple Security Update 2006-003. This and other updates are Disable “Open ‘safe’ files after downloading”<\/p>\n For additional protection, disable the option to “Open ‘safe’ files Appendix A. References<\/p>\n * Securing Your Web Browser – * Apple Security Update 2006-003 –
\n <www.kb.cert.org\/vuls\/byid?searchview&query=QuickTime_7.1<\/a>><\/p>\n
\n <www.us-cert.gov\/reading_room\/securing_browser\/<\/a>><\/p>\n
\n <docs.info.apple.com\/article.html?artnum=303752<\/a>><\/p>\n
\n <www.apple.com\/support\/downloads\/quicktime71.html<\/a>><\/p>\n
\n <www.apple.com\/quicktime\/download\/standalone.html<\/a>><\/p>\n
\n <docs.info.apple.com\/article.html?artnum=106704<\/a>><\/p>\n
\n ____________________________________________________________________<\/p>\n
\n Last revised: —
\n Source: US-CERT<\/p>\n
\n * Apple Mac OS X Server version 10.3.9 and version 10.4.6
\n * Apple Safari web browser
\n * Apple Mail<\/p>\n
\n Security Update 2006-003 for further information.<\/p>\n
\n vulnerabilities affecting Mac OS X, Mac OS X Server, Safari web
\n browser, Mail, and other products. The most serious of these
\n vulnerabilities may allow a remote attacker to execute arbitrary code.
\n Impacts of other vulnerabilities include bypassing security
\n restrictions and denial of service.<\/p>\n
\n affecting Mac OS X, OS X Server, Safari web browser, Mail, and other
\n products. Further details are available in the individual
\n Vulnerability Notes.<\/p>\n
\n specific impacts, please see the Vulnerability Notes. Potential
\n consequences include remote execution of arbitrary code or commands,
\n bypass of security restrictions, and denial of service.<\/p>\n
\n available via Apple Update.<\/p>\n
\n after downloading,” as specified in “Securing Your Web Browser.”<\/p>\n
\n <www.us-cert.gov\/reading_room\/securing_browser\/#Safari<\/a>><\/p>\n
\n <docs.info.apple.com\/article.html?artnum=303737<\/a>><\/p>\n