-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
A  U  S  C  E  R  T                                           A  L  E  R  T

                       AL-2007.0111 -- AUSCERT ALERT
                                [Win][OSX]
         QuickTime and iTunes - browser integration vulnerability
                   allows remote compromise via Firefox
                             13 September 2007

===========================================================================

        AusCERT Alert Summary
        ---------------------

Product:              QuickTime 7.2 and prior
                      iTunes 7.4.1 and prior
                      Firefox 2.0.6 and prior
Operating System:     Windows
                      Mac OS X
Impact:               Execute Arbitrary Code/Commands
Access:               Remote/Unauthenticated
Member content until: Thursday, October 11 2007


OVERVIEW:

	The QuickTime player on Windows and Mac OS X installs a plugin 
	that integrates with the Firefox and Internet Explorer web browsers.

	A web page referencing a malicious Quicktime Media Link file can cause
	Firefox to execute arbitrary code, remotely compromising the computer. 

	The malicious content may be disguised by renaming to several other 
	media file types supported by QuickTime, such as .mp3 or .mov, which
	by default will also be automatically opened by the browser plugin.
	
	Since QuickTime is supplied as a component of Apple iTunes, 
	iTunes installations are also affected by this vulnerability.


IMPACT:

	When the user visits a malicious web page using Firefox, a remote 
	attacker may execute arbitrary code, compromising the computer.  
	No further user interaction is required.

	Example exploits for this vulnerability have been publicly posted. 

	In the case of Internet Explorer this vulnerability reportedly allows 
	running arbitrary javascript in the Local Computer zone but not 
	remote compromise of the computer. [1]


MITIGATION:

	No update is yet available fixing this vulnerability. 

	Until an update is available, consider disabling the QuickTime plugin 
	in the web browser [2] or use the "NoScript" Firefox add-on [3].
	Users should also avoid opening untrusted files with the QuickTime 
	application. 


DETAILS:

	When handling malicious Media Link files the plugin may invoke Firefox 
	with unsafe arguments allowing the attacker to execute javascript with
	chrome privileges. 

	This can then be leveraged to execute arbitrary code on the computer, 
	with the privileges of the user. 


REFERENCES:

	[1] GNUCITIZEN blog entry
	    http://www.gnucitizen.org/blog/0day-quicktime-pwns-firefox

	[2] mozillaZine - Disabling plugins
	    http://kb.mozillazine.org/Issues_related_to_plugins
	
	[3] NoScript Firefox add-on
	    https://addons.mozilla.org/en-US/firefox/addon/722


AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRujufSh9+71yA2DNAQLFSwP8DfuVRfOxjJAXTbqNPN2c36K+c1R++Jeg
V7brrGrynVaKRJRKr31n5foEAlV+/cYfXm9rW2QNPfCsmgZwa83iBmfw4yrhO/mL
6V5z8upuvcSum7moh5O3q5d+xlWhlFZnPTnn8Sp9AYG09Hr4Iaq8ceYbuGZwReFy
TmYpADnmnbI=
=AGrY
-----END PGP SIGNATURE-----