Apple today released Security Update 2007-001, the first update of 2007. The update addresses an issue raised by MoAB.
Security Update 2007-001 is recommended for all users and improves QuickTime security.
The update is available in Universal format (4.9MB) and a version is also available for Panther (2.4MB).
Apple describes in detail the issues addressed by the update.
Available for: QuickTime 7.1.3 on Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.8, Mac OS X Server v10.4.8, Windows XP/2000
Impact: Visiting malicious websites may lead to arbitrary code execution
Description: A buffer overflow exists in QuickTime's handling of RTSP URLs. By enticing a user to access a maliciously-crafted RTSP URL, an attacker can trigger the buffer overflow, which may lead to arbitrary code execution. A QTL file that triggers this issue has been published on the Month of Apple Bugs web site (MOAB-01-01-2007). This update addresses the issue by performing additional validation of RTSP URLs.