Friday, May 13, 2005
Vulnerability in Quartz Composer files
The linked article describes a vulnerability in Quartz Composer files, which are used by QuickTime on Mac OS X. The claim is that under OS X 10.4, but not earlier versions, a malicious file can leak information to an outside point. Simply viewing a Web page can trigger the vulnerability in some cases.
I'm not familiar with the format, but the description of the problem implies that the vulnerability results not from coding bugs, but from a "design error" -- a failure to consider the consequences of combining features which appear innocuous separately.
An article on MacNN discusses the vulnerability. Several commenters argue that the details of the vulnerability should not have been made public, because that makes it easier for others to exploit it maliciously. But if the weakness is in the design of the format, it's important for as many software designers as possible to be aware of this, so that they won't make similar mistakes.
