MoAB flaw makes Flip4Mac flip

Stephen Withers
Sunday, 28 January 2007 15:33

Your IT - Home IT

The Flip4Mac QuickTime components - popular among Mac OS X users as they allow playback of Windows Media files - include an exploitable bug, according to the Month of Apple Bugs.

A maliciously crafted WMV file containing an invalid ASF_File_Properties_Object size field is not correctly handled by Flip4Mac. Instead, memory corruption occurs in a situation that can lead to arbitrary code execution, Kevin Finisterre and LMH claimed.

"[E]xploitation for arbitrary code execution is clearly possible," they wrote, adding that a "working exploit for this issue might be developed later today and released as soon as it's been tested and known to be reliable."

MoAB recommends disabling Flip4Mac (or at least the automatic opening of WMV files) until a fixed version is provided by Telestream.