Quicktime exploit: may affect SL viewer ?

There currently is an unpatched vulnerability in the Quicktime real time streaming protocol that can be exploited:
http://www.theregister.co.uk/2007/11/29/new_quicktime_exploit/

I believe this can be abused within Second Life by pointing the parcel streaming media URLs to a malicious source. Until I know whether it is exploitable in this way, I'll keep streaming media disabled in my viewer or limited to trusted sources.

Hi Jesrad,

Disclaimer: I know nothing about anything really....

This sentence stood out for me though:

"In order for the exploit to work, an attacker would have to trick a user into clicking on a booby-trapped link, or playlist."

and this one:

"Researchers have been chiming in about the vulnerability over the past few days, often offering conflicting analyses of exactly how effective the attacks are when used in combination with specific browsers"

I´m wondering whether this mean you have to click an internet browser link to get hit? And if so, this could be the same thing that was discussed here a while back? I seem to remember that there was something gong on with a risk occurring when clicking an internet link from within SL.

I couldn´t live without my streaming music

I don't want to get the heavier harder on my computer update I really hope they don't make it manatory to update because of this exploit.
I don't use my sound in SL very rarely so its mute point for me.

the streaming meida urls are the same thing as if you'd clicked a link so yes, SL may be vunerable through that vector, depending on how it's implemented...

from a cursory glance at the code, it looks like music streams would be vunerable too...

of course it requires, A) someone with access to the land stream controls, B) intent to do harm, and C)knowledge of how to use the exploit to do harm

many people don't realize, there are much worse things than stealing your computer info, or crashing your system.... like using it as a remote storage for child porn or other illegal content (happened to a friend), using it to attack websites (DDoS attacks, happened to another friend), using it to attempt to break into other computers... the list goes on

As Void Singer said, the SL viewer does all the browsing and connecting already, when you move to a new parcel and it starts playing the music stream it's roughly the same as if you had clicked on the streaming URL, opened a browser window, and launched the QuickTime player's playback.

Actually (having had my third cup of coffee),
I´m coming at this from a live music freak point of view btw....
I´m aware that anyone who has access to a live music stream has access to info about the systems of those listening.
I just figure that, as Void said, it would take someone with bad intent to do anything with any of this. And I can´t see the average venue owner in that light.
But it does sound a bit worrying.
Thanks for pointing it out btw.

OK, I understand now. Yes, it would take a malevolent land holder to set up a "trapped parcel" that you would visit with streaming activated, in order to infect your computer.

So, we're reasonably safe as long as we only listen to music or watch videos in trusted places.

Video can be force-started by a script, so you'd have to disable it entirely until you actually want to watch one.

In checking the objects on my land, I discovered that the flatscreen TV I'd installed was owned by someone unknown to me - Pittys Piaggio - and when I checked the profile there was nothing but the rezdate 12/2/07. I can't remember using it in the past several weeks and when I did it was to view the music videos listed in SL program menu.

I have all permissions turned off - create objects, object entry, and run scripts ... I'm confused as to how this alt could change the ownership of my TV, and I wonder if there was some exploit connected with it.

Thanks!

Can't tell you anything about that particular problem, but Apple has released a fixed version, you should install that!

/327/84/229725/1.html

If you dont watch video in SL is Quick Time really needed?....I uninstalled it when I heard about the exploit. Have I done something I shouldnt have and should I reinstall?

It seems my TV plays "All Your Base Are Belong To Us" constantly. Should I be worried?

Did you have the TV shared with a group? If so, it's possible someone in the group made a copy and deleted your original.


If you don't plan on watching video, then no, Quicktime is not needed. You didn't break anything by uninstalling it. So don't worry.

However, you can now safely install the latest version of Quicktime with nothing to worry about. The exploit has been patched. Just make sure you don't have an old version running on any machine you use.