The patch comes 23 days after details of the flaw, along with detailed attack code, were publicly released. The publication kicked off the "Month of the Apple Bugs" project, which has been publishing a new Apple software bug each day in January.
The QuickTime vulnerability relates to how the media player software handles the Real Time Streaming Protocol, or RTSP, according to an Apple alert. An attacker could exploit the flaw and commandeer a vulnerable system by placing a special RTSP string in a QuickTime file and tricking a user into opening that file, Apple said.
"A buffer overflow exists in QuickTime's handling of RTSP URLs," according to the Apple alert. "By enticing a user to access a maliciously-crafted RTSP URL, an attacker can trigger the buffer overflow, which may lead to arbitrary code execution." The update addresses the issue by performing additional validation of RTSP links, Apple said.
Security-monitoring companies Secunia and the French Security Incidence Response Team, or FrSIRT, have rated the QuickTime problem as "highly critical" and "critical," respectively. Still, experts have not seen widespread exploitation of the problem.
One of the bug hunters behind the Month of Apple Bugs said he is stunned by the time it took Apple to fix the flaw. "Twenty two days for a remote issue that leads to code execution right away is sort of insane," the pseudonymous LMH said in an interview via instant message. "There was already an exploit and it was being abused in targeted attacks."
The vulnerability affects QuickTime 7.1.3 on Mac OS X and Windows. Several other vulnerabilities in Apple software have been disclosed as part of the Month of Apple Bugs, including in QuickTime. Apple has not yet released fixes for those issues.
Apple has said that it is aware of the project, but has chosen not to comment beyond a standard statement that it takes security very seriously and has "a great track record of addressing potential vulnerabilities before they can affect users. We always welcome feedback on how to improve security on the Mac."
The Apple patch can be downloaded and installed via the Software Update feature in Mac OS X, or from Apple Downloads.
