QuickTime opens up a security leak in Firefox
The problem comes up when the QuickTime plug-in in Firefox processes QuickTime link files (.qtl). As a rule, these XML files contain a link to the actual media file and, in some cases, yet more control instructions that the QuickTime player obeys. QuickTime interprets these instructions even if the file has a different filename extension that is also associated with the QuickTime plug-in, such as .mov or .mp3.
But Petkov does not explain how users can protect themselves. Users report that the NoScript extension blocks the sample exploits that Petkov provides in his blog to demonstrate this security hole. When tested by heise security, the sample exploits did indeed fail if the NoScript extension was installed. Another alternative is to uninstall QuickTime. Affected uers should therefore either install the NoScript extension, set up a different default browser such as Opera, or uninstall QuickTime until Apple issues an updated software version.
- 0DAY: QuickTime pwns Firefox, security notice from pdp