Terri Forslof, manager of security response at 3Com's TippingPoint division, which rewarded $10,000 to security researcher Dino Dai Zovi after finding a flaw for Apples Safari browser in last week's CanSecWest security conference, has disclosed that the vulnerability actually lies in the way Apple's QuickTime Media Player works with the Java programming language. QuickTime runs on both Windows and the Mac, meaning both operating systems can be attacked.
The bug "is the equivalent to a 'click and you're owned' vulnerability," said Forslof. Because the flaw has not been publicly disclosed, it is not considered to be a significant threat to QuickTime users. Dai Zovi, who lives in New York, used a URL to expose the hole. He said he has reported at least eight security vulnerabilities to Apple and has had "nothing but positive interactions" with the company.
Tools: Post a comment | Link to this news item | Send to a friend | Submit News
Error: You are not logged in.
In order to leave comments to news articles you must be a Cyber Tech Help Member.
Registration is completely free!
Register to become a member
Along with access to leave comments to news articles you will be able to ask any computing questions you might have on the Cyber Tech Help Forums.
