-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
AA-2006.0096                  AUSCERT Advisory

                              [Win][Mac][OSX]
     Apple QuickTime feature allows execution of arbitrary JavaScript
                              7 December 2006
- ---------------------------------------------------------------------------

        AusCERT Advisory Summary
        ------------------------

Product:              Apple QuickTime
Operating System:     Windows
                      Mac OS X
Impact:               Execute Arbitrary Code/Commands
                      Cross-site Scripting
Access:               Remote/Unauthenticated
Member content until: Wednesday, January 03 2007

Revision History:     December 7 2006: Updated document to reflect that this 
                                       is a feature not a vulnerability
                      December  6 2006: Initial Release

OVERVIEW

        A feature of Apple's QuickTime movie files (.mov) allows the
        execution of arbitrary JavaScript [1][2].

        This behaviour is currently being exploited by a new worm
        spreading through the MySpace website. The worm modifies the
        MySpace page of affected users to both ensure its continued
        spreading and to redirect visitors to a password-stealing website.
        It also appears to attempt to redirect traffic to pornographic
        websites, possible for the purpose of financial gain through
        advertising or 'click-through' revenue.


IMPACT

        Sites that allow embedding of arbitrary QuickTime files may be
        vulnerable to cross-site scripting and phishing attacks. Users of
        these sites may have their credentials stolen, or have any content
        they are able to edit on that site altered, all without user
        interaction past the initial visit to the infected site.


DETAILS

        Apple QuickTime movies allow the embedding of JavaScript through
        the 'HREF' text tag. This tag is honoured without user interaction,
        and there is no option to disable this feature.

        This feature is being used by a new worm on the MySpace web
        site to spread and steal login credentials.

        Users of MySpace who are affected by this worm will have their
        MySpace page modified. Users of MySpace who follow one of the fake
        MySpace links created on infected user's pages and then enter their
        login details will have their MySpace logins stolen, and their
        account will be used to send spam messages.

        Infection does not require user interaction - simply having an
        infected page in your MySpace friends list can result in infection.


MITIGATION

        Apple QuickTime does not support an option to prevent HREF text tags
        being honoured, and there is no 'Ask for permission' setting. At
        this stage the only mitigation is to disable automatic movie viewing
        within QuickTime and to avoid playing embedded QuickTime media.

        This can be done within QuickTime's System Preferences. In the
        "QuickTime" pane, select the "Browser" tab and unselect "Play movies
        automatically" [3].

        QuickTime users, especially those who use MySpace, should apply this
        mitigation immediately until a more permanent fix is found.


REFERENCES

        [1] http://blog.spywareguide.com/2006/12/myspace_phish_attack_leads_use.html

        [2] http://www.f-secure.com/weblog/archives/archive-122006.html#00001038

        [3] http://www.macfixit.com/article.php?story=20061204120934568

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRXewrCh9+71yA2DNAQL6/wQAjeEFSn9XcwGbxboCWYC0IgHEPDuAHZ4g
UFVc2JcDMJLSapflvL9ugETZNRjKxG92Bmdnoq/YcSkP96NmnjnIar5SfQlcHFgZ
DQgEmW4HwYx9pAgJoAHRFC6ErmiqZpstgSxgS28mvGtTyIzGZVJWt7KmRNmkfNZT
zJPU0oz5/iU=
=Q4Fl
-----END PGP SIGNATURE-----