More reports of the Apple Quicktime "_Marshaled_pUnk" vulnerability being exploited in the wild. The first sign of in the wild active exploitation was almost 5 days ago (Sept 2nd).
This alert was released today by Websense.
----------------------------------------------------------------
http://community.websense.com/blogs/securitylabs/archive/2010/09/07/quicktime-0-day-actively-used-in-the-wild.aspx
Following our recent posting of an Apple Quicktime 0-day [“_Marshaled_pUnk”] vulnerability, Websense Security Labs™ ThreatSeeker™ Network has discovered exploitation of this vulnerability in the wild.
----------------------------------------------------------------
Where is the Apple on this? Who knows. Official mitigation recommendations from Apple? There aren't any. Apple continuing to falsely 'save face' over actually protecting their software users? Looks like it.
However, other vendors are more helpful...
Both VUPEN and Secunia, recommend setting the killbit for the affected ActiveX control (02BF25D5-8C17-4B23-BC80-D3488ABDDC6B) or you could just rename the plugin (QTPlugin.OCX) until a patch is released.
No comments:
Post a Comment