[mchFree] [MCH] Digest Number 1378
- From: "Mike" <mikebike@xxxxxxxxx>
- To: mch@xxxxxxxxxxxxx
- Date: Fri, 13 May 2005 09:15:07 -0700
There are 2 messages in this issue.
Topics in this digest:
1. Apple QuickTime Quartz Composer Disclosure of System Information
From: K-lang <cade00000@xxxxxxxxx>
2. MCH Forums
From: "Sean" <spunkovision@xxxxxxxxx>
________________________________________________________________________
________________________________________________________________________
Message: 1
Date: Fri, 13 May 2005 01:32:47 -0700 (PDT)
From: K-lang <cade00000@xxxxxxxxx>
Subject: Apple QuickTime Quartz Composer Disclosure of System Information
Secunia Security Advisories
----------------------------------------------------------------------
TITLE:
Apple QuickTime Quartz Composer Disclosure of System Information
SECUNIA ADVISORY ID:
SA15307
VERIFY ADVISORY:
http://secunia.com/advisories/15307/
CRITICAL:
Not critical
IMPACT:
Exposure of system information
WHERE:
From remote
OPERATING SYSTEM:
Apple Macintosh OS X
http://secunia.com/product/96/
SOFTWARE:
Apple QuickTime 7.x
http://secunia.com/product/5090/
DESCRIPTION:
David Remahl has reported a weakness in Apple QuickTime, which can be
exploited by malicious people to disclose some system information.
The problem is that Quartz Composer compositions embedded in ".mov" files
can access certain system information, which can be disclosed to web sites
via JavaScript. This can e.g. be exploited to disclose the local username
and directory information by tricking a user into visiting a malicious web
site.
SOLUTION:
Disable the QuickTime browser plugin and do not open ".mov" and Quartz
Composer files from untrusted sources.
PROVIDED AND/OR DISCOVERED BY:
David Remahl
ORIGINAL ADVISORY:
http://remahl.se/david/vuln/018/
----------------------------------------------------------------------
---------------------------------
Do you Yahoo!?
Yahoo! Mail - Find what you need with new enhanced search. Learn more.
[Non-text portions of this message have been removed]
________________________________________________________________________
________________________________________________________________________
Message: 2
Date: Fri, 13 May 2005 13:12:19 -0000
From: "Sean" <spunkovision@xxxxxxxxx>
Subject: MCH Forums
Just want to let everyone know that I just created a new computer
support forum site. I am in the process of testing its configurations
and users settings. I'm still learning how to use some of the
features. But the site is at its seminal stage. I have already created
3 forums and posted three reference articles for members to avail of.
This site may not be for everyone, specially dialup members, since you
have to be online at the time you are reading the postings, instead of
downloading the messages. But if you are interested to join do let me
know privately so I can give you the website address where you can
read the postings (right now, there are just a few long articles to
read at The Library Forum) and register. As of yet, I will only give
the site address to MCH, MCH-PCTips & Steveandjohnnie members only and
members of other allied Yahoogroups such as Pro_Tech and
ComputerSupport_2.
Sean
________________________________________________________________________
________________________________________________________________________
see the Yahoo home page
http://groups.yahoo.com/group/mycomputerheadaches/
See the self help page here
//www.freelists.org/cgi-bin/webpage?webpage_id=mch
Other related posts:
- » [mchFree] [MCH] Digest Number 1378
