<A HREF="http://www.eweek.com/article2/0,1759,2222299,00.asp?kc=EWRSS03119TX1K0000594">Exploit code is out</A> for an extremely critical Apple QuickTime flaw that affects Windows and Mac OS X systems, and researchers say attacks are likely soon to follow. The vulnerability, found in the way QuickTime processes RTSP (Real Time Streaming Protocol) replies, can lead to remote attackers hijacking vulnerable systems. This proof of concept code was posted on Nov. 23 by security researcher Krystian Kloskowski.

The flaw, caused by a boundary error when processing RTSP replies, can be exploited to cause a stack-based buffer overflow if an attacker sends a rigged audio-streaming file that contains an overly long Content Type header. Otherwise, an attacker can successfully exploit the vulnerability by modifying an existing program to listen for RTSP requests and to respond with malicious code.