DIRECTSHOW, a framework for playing various media types, is being exploited in the wild in older versions of Windows, Microsoft has warned.
In a statement, the Vole said that the attacks use malicious Quicktime media files and can cause remote code execution in the context of the logged-in user.
There is no patch for the vulnerability yet, but Microsoft has created a workaround registry script that you can download and run, at the Knowledge Base Article 971778.
The flaw apparently is in Directshow versions 7, 8 and 9 in Windows 2000, Windows XP and Windows Server 2003. Windows Vista, Windows Server 2008 and Windows 7 don't seem to have the problem. µ
Quicktime has to be the most pointless video player in existence and now its hurting the Mighty Vole.
It funny but over the years I have noticed that MS seems to find this kind of stuff just before they release a new OS. The new OS doesn't have the problem, hint, hint.
Another reason to us Linux or Mac if you got the cash.
Small Snip Stolen from theREG:
Microsoft on Thursday announced what it calls a launch event for Silverlight 3, and it's set for July 10.
Silver light 3 beta is WDK, or ?Write it Yourself, So its fast turnaround for developement this year.
Silver light 3 goes beyond Browser, Beyond H.264, beyong Shimer of Silverly Moon. Competes directly with adobe Flash & Java, Its another bunch o' small steps Up, for everyone with Windows. & Right After Boxing Day....
Directshow support for quicktime files is very very limited and only QT6 and earlier.
OH woe is me. Who do I give my $300 too. I hope MS doesn't find anymore flaws in their software. I mean I only have so much money to go around.
Looks like I'll have to take my Grandkids off my Christmas list. Maybe their birthdays too, just so I can give to MS and their flaws. I wish just once they would have a recall on their products. Maybe give me a discount if I turn in my old xp for the new Win7.
QuickTime is retarded, I don't even use it on my mac I use VLC
So if you read the official MS documentation (http://support.microsoft.com/kb/971778) right down at the bottom they slipped this pithy little statement:
"Impact of the workaround - QuickTime content playback will be disabled."
Does it really mean this? I just ran this wonderful reg. hack on a XP SP3 workstation and afterwards a .MOV file played just fine, at least it did in QT Player. In WMP (v11) it played just the audio and gave an "Unknown error" about the video. However knowing WMP it may well have never worked properly. Plus I haven't rebooted yet and I can never figure when these Registry changes take effect.
"The flaw apparently is in Directshow versions 7, 8 and 9 in Windows 2000"
You don't need to bother patching a machine with Windows XP SP3, they are not affected.
But it's a simple enough fix:
http://support.microsoft.com/kb/971778
Tells you how.
that everybody buy either Vista or 7 so they can make some more money.
The bug is not in Apple's QuickTime, it's in Microsoft's DirectShow, damnit!
Can't anyone fucking read anymore?
QuickTime is a structured file format plus codecs, like AVI. Microsoft tried to parse the QT structures and screwed it, as usual.
But all is not lost. Microsoft emphasizes this is not a browser based bug, it's in DS. The browser is only an attack vector. Thanks Microsoft, I feel a lot safer now!
Vista is not in danger, probably because they removed their half-assed QuickTime implementation just-in-time.
Unfortunately, nobody uses Vista...
Microsoft should release an MS version of linux, could you imagine, what a thought.....and don't laugh if there's money in it they'll do it.
Ok. Microsoft has had its fair share of stuff ups. But when you support software and hardware for the world+dog you cant be pointing the finger at MS all the time. The majority of these kinds of security and incompatibility faults reside from the INCORRECT IMPLEMENTATION of lazy, stupid coders who do not follow the clearly provided and defined API contexts. Not a fault in QT...a fault in its implementation...funny how selective this problem is...
When Apple actually INVENT something besides a better plastic box for IC's then i'll give them some cred. Fantastic marketing company but they can't always rely on the 80-90's glory days of Photoshop on a Mac.