Latest post Tue, Sep 20 2016 6:46 PM by Marianna. 96 replies.
Page 5 of 7 (97 items) « First ... < Previous 3 4 5 6 7 Next >
Sort Posts: Previous Next
  • Wed, Apr 20 2016 2:15 PM In reply to

    • DStone
    • Top 50 Contributor
    • Joined on Fri, Nov 4 2005
    • Massachusetts
    • Posts 3,686
    • Points 47,305
    • Moderator: Avid Media Composer for Liquid
      Moderator: MCA Mac
      Moderator: MCA PC
      Moderator: Media Composer Getting Started

    Re: Alert issue with QuickTime for Windows..?

    The problem is not in the player, but in the runtime itself. When decoding the data stream (which contains descriptors about the media as well as the media data itself), a maliciously designed descriptor opens the door.

    This is the most classic of all poor programming techniques!! The runtime is not checking the descriptor for the length of the data that follows. So if there is a buffer that's 8K long, the descriptor is specified as being longer (e.g. 16K). The first 8K contains junk. The second 8K will overwrite any code beyond the end of the buffer.

    What the hackers do is figure out where program will go after filling the buffer, and overwrite that code with their own code. This happens in the context of the user. Which means they can do anything you can do (or why you want to avoid runing as administrator when possible).

    Because this is in the runtime, AMA is effected, along with everything else. As I meantioned in an earlier post, if all you're doing is processing your own stuff (e.g. QT Ref, SAS, reading .MOV files from your own cameras, etc.) you're fine. If you download a malicious .MOV file and import/link to it, you will fire off the malicious code.

    DIY quad core I7-4790K, 32Gb, NVidia GTX 970 4GB, Win 10 Pro, MC(generally the latest or the one just before), MC 7.x [view my complete system specs]

    Dave S.

  • Wed, Apr 20 2016 2:20 PM In reply to

    • DStone
    • Top 50 Contributor
    • Joined on Fri, Nov 4 2005
    • Massachusetts
    • Posts 3,686
    • Points 47,305
    • Moderator: Avid Media Composer for Liquid
      Moderator: MCA Mac
      Moderator: MCA PC
      Moderator: Media Composer Getting Started

    Re: Alert issue with QuickTime for Windows..?

    FWIW, it would be hard for Windows Defender or other ant virus app to stop this. Because any code can be inserted, there won't be a consistent signature in the file for the virus scanners to latch onto. And you can't look for a bad descriptor without actually parsing out the file, which an anti virus program isn't going to do.

    The best thing Apple could do in this case is to publish the source code for QT and let someone else fix it. But I doubt they're going to do that.

    DIY quad core I7-4790K, 32Gb, NVidia GTX 970 4GB, Win 10 Pro, MC(generally the latest or the one just before), MC 7.x [view my complete system specs]

    Dave S.

  • Wed, Apr 20 2016 10:06 PM In reply to

    • TVJohn
    • Top 25 Contributor
    • Joined on Fri, Nov 4 2005
    • Bayonne NJ
    • Posts 4,334
    • Points 53,575

    Re: Alert issue with QuickTime for Windows..?

    What our IT will likely do is to push a global QT uninstall and block any transfer of any QT associated files, .ie movs, etc.

    Dell Display U2713HM(2560x1440), AMD FX8350 8core, AMD 990FX mobo, 32gig-DDR3-1600, Quadro K620/GTX260/core 216, Audigy2zs, 1TB SSD system drive, 2TB SATA... [view my complete system specs]

    Using MC 8.4. Avid FX6.4, Vegas Pro 15/ DVD Architect 6pro, DVDit6.4proHD, CCE Basic, TmpGe Express4, TmpGe Authoring Works 4, DVDLab-Studio. Sony EX-1R, Canon XH-A1, GL2, GL1, Canon EOS 60D

  • Thu, Apr 21 2016 12:07 PM In reply to

    • lalittle
    • Top 200 Contributor
    • Joined on Thu, Oct 13 2005
    • USA
    • Posts 532
    • Points 7,310

    Re: Alert issue with QuickTime for Windows..?

    DStone:

    The problem is not in the player, but in the runtime itself. When decoding the data stream (which contains descriptors about the media as well as the media data itself), a maliciously designed descriptor opens the door.

    ...

    If you download a malicious .MOV file and import/link to it, you will fire off the malicious code.

    Do I understand correctly that other programs can still open mov files even without QT being installed?  If so, does this mean that as long as ANY program has the ability to open mov files, the exploit could be triggered?  Or, do you need at least the core quicktime program installed for the exploit to take place?

    On a related note, would there be any way that the exploit could work without someone specifically playing a QT file?  Are there any clever ways of taking advantage of the exploit such that people could accidentally trigger it without intentionally "playing" a compromised mov file?

    Thanks again for clarification on this,

    L

  • Fri, Apr 22 2016 2:48 AM In reply to

    • Keith R
    • Top 500 Contributor
    • Joined on Fri, Jun 8 2012
    • Posts 286
    • Points 3,370

    Re: Alert issue with QuickTime for Windows..?

    (Most worrisome is that there are two security vulnerabilities and proven that they will not be corrected by APPLE. )

    In plain english what does this mean for the Mc 8.5.2 user today who has been using Quick Time for export since the change out from Liquid Edition...ie:- what does "two security vulnerabilities" mean ....

    Reading all the postss on this issue hopefully Avid will deal with it ..I'm not going to pull the chain on it until there is an official response from Avid ..?? 

  • Fri, Apr 22 2016 8:39 AM In reply to

    • jcfrance
    • Not Ranked
    • Joined on Wed, Apr 21 2010
    • Posts 31
    • Points 300

    Re: Alert issue with QuickTime for Windows..?

    Hello,

    Is this a workaround to quicktime security flaws ?

    I do not know but on this site it says so.

    http://www.iso1200.com/2016/04/quicktime-security-issue-how-to-keep.html

    Below is a video + download link is on this page.

    I'll test ASAP on a fully PRORES project.

  • Fri, Apr 22 2016 10:18 AM In reply to

    • BarkinMadd
    • Top 25 Contributor
    • Joined on Fri, Nov 4 2005
    • Ontario, Canada
    • Posts 4,707
    • Points 61,490

    Re: Alert issue with QuickTime for Windows..?

    I watched that video - it claims that the security holes are in the QT player itself but I don't believe I've heard that yet (and I question its validity). QT Lite? Not so sure. Does anyone know for certain where the two security holes reside? Are they in the player or in the core essentials?

    Camera(s) PXW-X70, HDR-FX1, Hero 6 Black | MC 2019.9 | QT 7.7.9 | Continuum 2019.5 | Sapphire 2019.5 | Mocha Pro 2019.5 | Titler Pro 7 | Windows 10 Pro... [view my complete system specs]

    Steve

    ______________________

    www.nelliedogstudios.com

  • Fri, Apr 22 2016 11:53 AM In reply to

    • jcfrance
    • Not Ranked
    • Joined on Wed, Apr 21 2010
    • Posts 31
    • Points 300

    Re: Alert issue with QuickTime for Windows..?

    As what can be read on this page April 15, 2016:
    http://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/windows-pc-users-uninstall-quicktime-for-windows-now

    Users of QuickTime player for Windows are Advised to uninstall the program, due to the discovery of critical bugs That May not be patched. The recommendation is based on the discovery of two critical vulnerabilities on the media player software That might not be fixed soon Any Time. etc ...

    So it would be the quicktime player. No ?

  • Fri, Apr 22 2016 2:41 PM In reply to

    • Hugh Moore
    • Not Ranked
    • Joined on Mon, Mar 29 2010
    • South Australia
    • Posts 44
    • Points 570

    Re: Alert issue with QuickTime for Windows..?

    Ive uninstalled Quicktime and now no video in timeline or anywhere with Mc. Can hear audio, but no video or graphics.

     

    Doh!

     

    Assume need to do uninstall/reinstall of MC.

     

     

    Hugh 

    MC 8.3.1 

    MC 8.3.1 MB: Gigabyte EX58-UD5 Video: Nvidia GeForce GTX750 RAM: 12 GB Windows 10 Boot Drive: SSD Monitors: Dual User: Hobbyist [view my complete system specs]
  • Fri, Apr 22 2016 3:05 PM In reply to

    • Joachim Claus
    • Top 150 Contributor
    • Joined on Fri, Nov 4 2005
    • Seeheim-Jugenheim, Germany
    • Posts 944
    • Points 12,055

    Re: Alert issue with QuickTime for Windows..?

    cuervo:

    My vote is to replace .mov with .mxf. MXF is multi-platform, open source(?), etsablished, and already part of Media Composer

     

    MXF files can neither be imported into Squeeze nor into TMPGEnc.

    Joachim

    SuperMicro Workstation 7048A-T Dual Xeon (10 cores) E5-2640v4 2.4GHz 128 GB RAM, PNY P4000, 1 PCIe SSD 400 GB (Intel SSDPEDMW400G4) 1 SSD 2 TB for UHD... [view my complete system specs]

    Joachim Claus

  • Fri, Apr 22 2016 4:34 PM In reply to

    • jcfrance
    • Not Ranked
    • Joined on Wed, Apr 21 2010
    • Posts 31
    • Points 300

    Re: Alert issue with QuickTime for Windows..?

    Hi,

    Sorry for polluting the discussion but with QT Lite : MC 8.5.2 does not start and remains on splash with the message:
    initializes the manager of media streams
    Embarrassed

  • Fri, Apr 22 2016 6:04 PM In reply to

    Re: Alert issue with QuickTime for Windows..?

    Joachim Claus:
    MXF files can neither be imported into Squeeze nor into TMPGEnc.

     

    Avid MC works without QT Player. What you do outside of MC without it is another issue.

    Squeeze should have really supported MXF import long time ago.

     

    MC 2019.9, Windows 10, ASROCK X99M, Intel 5930K, Zotac RTX 2070 Super, 32GB RAM, Transcend 512GB M.2 SSD & Dell UP2718Q. MBP 2012 Thunderbolt, OSX... [view my complete system specs]
  • Fri, Apr 22 2016 8:30 PM In reply to

    • DStone
    • Top 50 Contributor
    • Joined on Fri, Nov 4 2005
    • Massachusetts
    • Posts 3,686
    • Points 47,305
    • Moderator: Avid Media Composer for Liquid
      Moderator: MCA Mac
      Moderator: MCA PC
      Moderator: Media Composer Getting Started

    Re: Alert issue with QuickTime for Windows..?

    There's way to much knee jerk reaction going on with this. The short solution is easy. Don't uninstall QT.  Uninstall the QT plugins for your web browsers.  Don't  play . mov files downloaded from the web or from an unknown  source.  That's  it.  If you're  only dealing with your own files,  you're  safe.  Change the defaults so the QT player doesn't  open any files by default.

    DIY quad core I7-4790K, 32Gb, NVidia GTX 970 4GB, Win 10 Pro, MC(generally the latest or the one just before), MC 7.x [view my complete system specs]

    Dave S.

  • Sat, Apr 23 2016 12:54 AM In reply to

    • Swil
    • Top 500 Contributor
    • Joined on Thu, Oct 13 2005
    • Australia
    • Posts 498
    • Points 6,455

    Re: Alert issue with QuickTime for Windows..?

    Joachim Claus:

    MXF files can neither be imported into Squeeze nor into TMPGEnc.

    This is an issue for Squeeze and TMPGEnc to fix ASAP. It's absurd they haven't done so already.

    3.40GHz Core i7-2600K | 24Gb RAM | GeForce GTX 660 Ti | Blackmagic DeckLink Mini Monitor | Presonus AudioBox 22VSL | Windows 10 because I'm mad like... [view my complete system specs]
  • Sat, Apr 23 2016 11:28 AM In reply to

    • BarkinMadd
    • Top 25 Contributor
    • Joined on Fri, Nov 4 2005
    • Ontario, Canada
    • Posts 4,707
    • Points 61,490

    Re: Alert issue with QuickTime for Windows..?

    DStone:

    There's way to much knee jerk reaction going on with this. The short solution is easy. Don't uninstall QT.  Uninstall the QT plugins for your web browsers.  Don't  play . mov files downloaded from the web or from an unknown  source.  That's  it.  If you're  only dealing with your own files,  you're  safe.  Change the defaults so the QT player doesn't  open any files by default.

    Agreed - in fact, I would remove the player as well.

    Camera(s) PXW-X70, HDR-FX1, Hero 6 Black | MC 2019.9 | QT 7.7.9 | Continuum 2019.5 | Sapphire 2019.5 | Mocha Pro 2019.5 | Titler Pro 7 | Windows 10 Pro... [view my complete system specs]

    Steve

    ______________________

    www.nelliedogstudios.com

Page 5 of 7 (97 items) « First ... < Previous 3 4 5 6 7 Next >

© Copyright 2011 Avid Technology, Inc.  Terms of Use |  Privacy Policy |  Site Map |  Find a Reseller