Apple QuickTime ActiveX Component Buffer Overrun
Vulnerability
A SecurityFocus Online article discusses a QuickTime Buffer Overrun
problem that could result in a security vulnerability:
"A vulnerability has been reported in the Apple Quicktime ActiveX
component for Internet Explorer. The vulnerability is a buffer
overrun condition that is due to inadequate bounds checking of
supplied arguments. If the component is invoked with the
"pluginspage" argument set to a string value that is of excessive
length, the overrun will occur. This condition is reportedly
exploitable and may result in attacker supplied instructions being
run on affected client systems."
This vulnerability is eliminated in version 6 of the QuickTime
ActiveX component, and SecurityFocus reports effective that an
effective workaround for QuickTime 5 users is to set the "Kill-bit"
for the ActiveX component. See Microsoft's instructions.
