Firefox Susceptible To QuickTime Security Flaw

Hugh Pickens writes "Apple's QuickTime media player software contains a previously undocumented security weakness in the way QuickTime handles the RTSP media-streaming protocol. The vulnerability is present in QuickTime versions 4.0 through 7.3 (the latest version) on both Windows and Mac systems. Symantec has tested the publicly available exploit code and found that it failed to work properly against Internet Explorer 6/7 or Safari 3 Beta but the exploit works against Firefox if users have chosen QuickTime as the default player for multimedia formats. Firefox users are more susceptible to this attack because Firefox farms off the request directly to the QuickTime Player as a separate process outside of its control, while IE loads the QuickTime Player as an internal plugin and when the overflow occurs, standard buffer-overflow protection is triggered, shutting down the affected processes before any damage can occur."

And this is a firefox problem...

[Shoeler]

Why? I mean help me understand how it simply farming the request to an external app, where the external app has the security problem, is a firefox problem?

Re:And this is a firefox problem...

[Volante3192]

Exactly...the way I'm reading this, if someone opens whatever this is straight in Quicktime it'd be vulnerable.

Guess they want the more hits by throwing Fox into the mess though, but really, why have Mozilla fix Apple's flaws?

Re:And this is a firefox problem...

[aredubya74]

It's not a Firefox problem inasmuchas a fix to Firefox itself will fix the problem. However, it's a reasonable idea to provide a heads-up to Firefox users (savvy and not-so-savvy) that a popular associated app it interacts with contains a flaw that appears to be unique to said pairing.

Besides, this is Slashdot. Since when did the headlines make sense?

How is this a firefox problem?

[rminsk]

So how is this a firefox problem? Firefox spawns off another process that has a flaw and it crashes. This process is completely outside of the memory space of firefox at this point.

Apple software not secure.

[Anonymous Coward]

So how many of these examples do we need to demonstrate that Apple software is not secure, and is only less exploited because it's less popular?

QuickTime == Java

[Anonymous Coward]

QuickTime is about as useful as java. A 'quick' 125Kb download, to install about 50Mb of crap on my system, and a damn useless
taskbar icon, using valuable desktop space, just to tell me, yay! you have QuickTime installed!

I make it a habit to simply not view quicktime content, it's usually not worth my 'time' quick or not.

Because of the end appearance

[Sycraft-fu]

When you use QT in Firefox, it appears in the FF window itself, it in a very real way seems to be part of FF. We aren't talking about opening a file that ten spawns another app, we are talking about opening something embedded in a page itself. As such FF is the one that is going to get blamed. Also, one can argue, they should share some of the blame. If you are loading a plugin in your app, perhaps you should load it in such a way that your app can keep control over it. Seems that the other browsers do this.

So while it isn't FF's responsibility to fix the specific bug, it could be an indication of how things should be done better.

MOD Parent Funnt

[Bryansix]

Cause that is what his post is.

Re:And this is a firefox problem...

[Shoeler]

Quicktime is causing the problem, but would you rather have a browser that arbitrarily trusts the plugin, or does some bounds checking?

I'd rather have a browser that focuses on making sites render most correctly, most quickly, and where only its core functions are concerns of the already burdened developers.

But that's just me talkin'.

Re:That does it for me...

[Homology]

Man, I'm using IE from now on. It's WAY more secure...

Funny that security is not touted as much as a feature anymore compared to the early Firefox releases.

Re:Safety through laziness.

[njfuzzy]

If you have a Mac, then you have QuickTime. If you have iTunes, then you have QuickTime. That may not apply to you, but its fair to say it covers a huge chunk of marketplace overall. (I believe people who download Safari 3 Beta for Windows, and Bonjour for Windows, also have QuickTime by default, but they are bound to be a very small group.)

Re:And this is a firefox problem...

[purpledinoz]

My solution is to not use QuickTime. What pisses me off about QT is that it puts itself in the Windows startup, eating up memory for no reason. In fact, I stopped using iTunes all together because it installs a couple of services AND QuickTime. Plus, it's such a pain in the ass when I plug in my iPod to charge, and my computer starts to kill itself loading up iTunes automatically. I use Winamp with the external ml_ipod plugin. It's much better.

Re:How is this a firefox problem?

[Anonymous Coward]

Because it is possible to have a better security model that doesnt spawn off another process.

Kind of like how on an old operating system that doesnt have seperate address spaces it isnt the OSes fault if you run a program that brings down the entire system. But there is a better OS design they could have used that would have prevented that. Same thing here, there is a better browser design that would have prevented this.

Design for maliciousness

[PhxBlue]

Software should be pessimistic. Design the code to handle incoming requests as potentially malicious, and you'll never be disappointed.

Phew

[lluBdeR]

Man am I glad my system seems to deal with this problem proactively: The Quicktime plugin crashes anything that contains it almost as soon as it's drawn!

Thank you Apple for protecting me from, well, Apple!

Re:How is this a firefox problem?

[Anonymous Coward]

Which is exactly the problem. It should not pass untrusted files to other trusted apps. It should keep it inside it's own buffer overflow protection bubble as IE does.

If this was an IE problem, you know the tagging beta would be full of 'defectivebydesign' and 'haha' remarks. But this is Firefox, so all is forgiven.

Re:Apple software not secure.

[Brainix]

Really? Where are the gozillion iTunes exploits? Or is iTunes "less popular" too?

Re:And this is a firefox problem...

[Shoeler]

Look - I'm a programmer. It may sound pedantic of me, but I believe programs should be responsible only for what they are designed to do. Clearly this means being responsive and indeed responsible for their own security. Lapses in one's own program are unavoidable but should be quickly and non-quietly fixed. It's an interesting suggestion that the paradigm needs to shift to the parent app being solely responsible for its children's security.

So taking your logic further, the OS should be responsible for all of this, so it's not even Firefox's problem. ^_^ Apps should be purpose built and responsible for that purpose. If you do the blame game up the line, you'll find tremendous bloat (more so than it already is) creeping into all first-line programs and even more so to the OS. If you don't blame Microsoft and OSX (the only two platforms Quicktime runs on, IIRC) as much as Firefox, you have violated your own thinking line.

A bigger problem

[0123456]

Is that there's apparently no way to simply disable a plugin in Firefox. In order to completely disable Quacktime I've had to go through various plugin directories physically deleting the files, and next time I have to update it all the bloody plugins will be back again.

Why can't about:plugins just have a 'disable' box on each plugin? Or, better yet, a standard preferences menu list which just lets me disable them there and then?

Re:Apple software not secure.

[Anonymous Coward]

Its more that itunes isnt opening untrusted files and connecting to untrusted servers. I guess you could consider mp3s to be untrusted, but most of them come from apple's servers so its not like you are downloading them from some random guy in russia.

Website's fault

[nbucking]

This problem's principle fault lies with Apple. But it seems that they are sitting on their asses because it seems to be a problem that has been around for awhile. So those websites that use quicktime should use flash player, media player, or realplayer. Heck I have gotten video lan to take care of them all but those who do not want the trouble should blame the stupid websites. As far as I am concerned about firefox not handling apple's screwup as well as the other browsers it is scary. Yet if quicktime is broken then even if you use the other browsers then it simply does not matter, you still have DoS.

Re:And this is a firefox problem...

[Anonymous Coward]

Simple, Firefox facilitates the Internet experience. Reffering to the bad car analogy, it's similar to Ford Explorer and GoodYear tires. Ford did not make the tires but the way they used them on Explorer made it unsafe for the passangers.

Re:And this is a firefox problem...

[Ethanol-fueled]

QT has become the new realplayer. iTunes sucks as well. I found it to be more counterintuitive than the godawful SonicStage for my SONY(don't laugh) mp3 player!

Re:And this is a firefox problem...

[Bill, Shooter of Bul]

I agree with your logic extension. If the operating system can prevent a security problem, it should as long as it can differentiate between the malicious behavior and normal application behavior. This is why such things as SELinux exist. Every part of the program in the stack should be responsible for its security and prevent any of its children from doing bad things as much as possible.

Re:And this is a firefox problem...

[everphilski]

The real problem here is the way Firefox handles the plugins. Or rather does not.

IE uses a plugin interface to deal with QuickTime. As such, it has a standard framework which does some bounds checking and can find buffer overflows like this one and kill a plugin (or iexplore.exe if necessary) preventing damage.
Firefox just passes parameters on to an external program.

Pick your poison, you can probably make justifications for either, but to me the IE method makes more sense. It's embedded content, it should be handled as a plugin to the parent application. You are a programmer, I'm sure you are familiar with the concepts of parents and children :). I'm a programmer too ... I have to sanitize my inputs and sanitize my outputs. When I call functions that aren't mine I have to make sure that they are doing what they should be doing, not wreaking havoc on my computer, and in a sense that's exactly what this comes down to, taking responsibility for a child process.

Re:Quicktime - default???

[47Ronin]

Of course. It comes with my Mac. It works well. I have the Perian, Divx, and Flip4Mac plugins so I can handle pretty much any codec, including FLV so I'm quite happy. It will also export pretty much anything. FAQ about QuickTime [apple.com]

Re:And this is a firefox problem...

[marcello_dl]

Uhm but let's say we have good dog IE terminating the plugin for an overflow. IE won't be able to tell if it's accidental or malware at work, so it will throw a generic error or a warning at most, and terminate. The user really wants to see "supersexy.mov" so he may be tempted to download or get it from the browser's cache (people getting pr0n likely know about the cache). Or the user got the file by email or downloaded it with a spider. This time Quicktime player is invoked and blam, user is Pwned. So either all players must do bounds checking (inefficient) or it should be the OS, not the browser, the one who babysits processes.

OTOH, babysitting probably takes up more resources so a paranoid OS will slow down. But IMHO the solution is still to taint dangerous stuff (what you got just downloaded) and have the OS babysit it.

Re:And this is a firefox problem...

[Lord Flipper]

*bends over ready for -5 apple bashing*

As an Apple user since 1979, all I can say is: You won't get bashed by me. I use VLC and MPlayer for just about everything except the wmv files that Flip4Mac handles as a QT plugin... heheh, using QT for Windows Media. The QuickTime Pro player on an adequate Mac, with the prefs set 'just right', is not a bad thing, but... when you absolutely want to playback anything (with minor exceptions), VLC is the way to go on the Mac.

I've seen latest QT Pro, in Leopard, on 4 Macs here, 'kick' an mp3 on the grounds that it "Can't play this movie file type", and all I can say is, WTF? Not sure if that's all QT's fault, or it's getting an assist from the wonky Apple HFS+ (UNIX-incompatible) file system, but whatever... vive la France!

Re:Quicktime is the FF plugin from hell

[caitsith01]

Yeah, that is annoying. They toyed around with the idea of making Quicktime optional, but they didn't like the idea of iTunes not being able to do kind of important stuff once it's installed like, I dunno... play music?

Weird huh?

Yeah, because without Quicktime installed in Windows it is simply not possible to do kind of important stuff like, I dunno... play music, is it?

Microsoft better make it part of the default Windows install pronto to give millions of users worldwide the ability to actually play music for the first time ever.

Of course, that old version of iTunes which didn't require Quicktime and didn't play music was a bit pointless, too.