New QuickTime exploit triggers the same old stack overflow

It would appear a January fix that supposedly protects against malformed URLs to the RTSC protocol of Apple's QuickTime wasn't a complete fix after all.

The US-CERT office of the Dept. of Homeland Security confirmed this morning that an intentionally malformed header sent to the Real Time Streaming Protocol handler of Apple's QuickTime for Windows, and presumably for Mac OS as well, will cause a familiar stack buffer overflow problem that could be exploitable from the outside.

A similar problem was addressed by Apple last January , when a patch was issued to guard against intentionally malformed URLs sent through RTSP protocol to QuickTime. But now the problem appears to involve overflowing the message header - not the URL to which the message is directed - with garbage characters at the end.