A Security Update for QuickTime 7.2 has been released to address the .qtl arbitrary code execution vulnerability publicly disclosed by pdp of gnucitizen.

Specifically, a command injection opportunity exists within the qtnext field in QTL files that could allow it to pass arbitrary command line arguments when opened by a vulnerable application. The update addresses the way that QTL files handle URLs internally.

Description:

Apple have released a Security Update for QuickTime 7.2 for Windows. This update addresses a publicly disclosed vulnerability that enables an attacker to potentially take control of a vulnerable system through the unique way that .qtl files handled and presented various content (demonstrated to affect XML content).

Mitigation:

Update to the latest version of QuickTime, available from the Updates link below, or from the Software Update Application (OS X)

Updates:

http://www.apple.com/quicktime

Source:

http://docs.info.apple.com/article.html?artnum=61798

Exploits:

Numerous

CVE-ID: CVE-2007-4673