Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Endpoint Security

No Patches for QuickTime Flaws as Apple Ends Support on Windows

Apple will no longer release security updates for the Windows version of QuickTime, leaving two recently-discovered remote code execution vulnerabilities unpatched.

The announcement that QuickTime for Windows is being deprecated was not made by Apple. Instead, Trend Micro-owned ZDI learned of the company’s decision after Steven Seeley of Source Incite reported finding two serious flaws.

Apple will no longer release security updates for the Windows version of QuickTime, leaving two recently-discovered remote code execution vulnerabilities unpatched.

The announcement that QuickTime for Windows is being deprecated was not made by Apple. Instead, Trend Micro-owned ZDI learned of the company’s decision after Steven Seeley of Source Incite reported finding two serious flaws.

The issues found by Seeley are heap corruption vulnerabilities that an attacker can exploit for remote code execution if they can convince the targeted user to access a maliciously crafted website or file.

“One vulnerability occurs an attacker can write data outside of an allocated heap buffer. The other vulnerability occurs in the stco atom where by providing an invalid index, an attacker can write data outside of an allocated heap buffer,” Trend Micro said in a blog post on Thursday.

The flaws were reported to Apple on November 11, 2015, and the vendor informed ZDI on March 9 that it’s deprecating QuickTime on Windows.

Apple has published instructions on how to remove QuickTime for Windows. The company told users that websites increasingly use HTML5 for video playback and advised them to remove legacy plugins to enhance the security of their PC.

The QuickTime plugin has been disabled in OS X and web browsers, which should prevent attackers from exploiting the vulnerabilities found by Seeley via a malicious website.

Advertisement. Scroll to continue reading.

US-CERT has also published an advisory on the matter, informing users that remote attackers could take control of their systems by exploiting vulnerabilities in QuickTime for Windows.

“Computers running QuickTime for Windows will continue to work after support ends. However, using unsupported software may increase the risks from viruses and other security threats. Potential negative consequences include loss of confidentiality, integrity, or availability of data, as well as damage to system resources or business assets. The only mitigation available is to uninstall QuickTime for Windows,” US-CERT said.

Apple released two security updates for the Windows version of QuickTime last year, patching a total of 18 vulnerabilities that could have been exploited to crash applications or execute arbitrary code. The last round of patches was released in January, when Apple fixed 9 memory corruption flaws that could have led to arbitrary code execution or the unexpected termination of affected apps.

Related: Over 60 vulnerabilities patched in Apple TV

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.

Register

Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.

Register

Expert Insights

Related Content

Endpoint Security

Today, on January 10, 2023, Windows 7 Extended Security Updates (ESU) and Windows 8.1 have reached their end of support dates.

CISO Strategy

Varied viewpoints as related security concepts take on similar traits create substantial confusion among security teams trying to evaluate and purchase security technologies.

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...

Endpoint Security

The Zero Day Dilemma

Endpoint Security

When establishing visibility and security controls across endpoints, security professionals need to understand that each endpoint bears some or all responsibility for its own...

Application Security

Password management firm LastPass says the hackers behind an August data breach stole a massive stash of customer data, including password vault data that...

Application Security

Microsoft on Tuesday pushed a major Windows update to address a security feature bypass already exploited in global ransomware attacks.The operating system update, released...

Application Security

Electric car maker Tesla is using the annual Pwn2Own hacker contest to incentivize security researchers to showcase complex exploit chains that can lead to...