The winner of a recent hacking contest has uncovered a security flaw that affects all Java-enabled browsers on all platforms' date=' according to a report by eWeek's Security Watch. The flaw was initially unveiled during the Pwn-2-Own (sic) conference, which promised a $10,000 bounty to hackers who could break into and/or gain administrative privileges on an Apple MacBook Pro notebook. The winner used an exploit involving QuickTime and Apple's Safari browser, but according to Security Watch, the exploit also affects other browsers and operating systems with QuickTime installed.

TippingPoint Security Response Manager Terri Forslof told Security Watch, "This is probably one of the biggest vulnerabilities we've seen. It affects every platform, every browser. It's widespread, and nobody's immune to this thing." Forslof even compares the flaw's severity to that of the recent animated cursor flaw that allowed remote code execution in various versions of Windows. There are reportedly no exploits using the QuickTime vulnerability yet, but security researchers are nonetheless urging all users of QuickTime (including iTunes users) to turn off Java (not JavaScript) in their browser.

every platform, every browser :eek: security through obscurity isn't a good idea...

I don't have QuickTime installed on any of my systems, but if it's a quicktime-related bug, you might be able to disable it in IE7 for the time being by using the tools -> manage addons option.

Not sure what the relevence of the "securituy through obscurity" link is though?

Ta for the heads up, andypandypoos

TKW, I took the "security through obscurity" reference to advise us that, whilst we all all know there might be security weaknesses in programs, it is less than comforting that in some cases these could be known by the designers who just hope no-one will find them. Hmmm...

Regards

Mo

Not sure what the relevence of the "securituy through obscurity" link is though?

He's a Mac hater

(Humour)

ah the good old reliable mac, no one can hack them as they are super secure yet the good old apple developers seem to have thught it was fine to make a weakness that will affect ANY computer regardless of platform, cheers!

Do ya think this would affect Quicktime alternative too?? :confused:

Do ya think this would affect Quicktime alternative too?? :confused:

It effects every version of Quicktime from 3 - 7, and you don't know which bit is affected - if Quicktime alternative is reverse-engineered, or just uses the codec and that's what is effected, you'll still be vulnerable :thumbdwn:

He's a Mac hater

(Humour)

I do realise you're teasing but that's not true - If I could have got an Apple computer through the Home Computer Initiative at work, I would have done, and I can see a Black MacBook on the cards once I've got some "spare" cash

new version of quicktime released which "addresses a critical security issue in QuickTime for Java" amongst other things:

Windows

Mac