[prev in list] [next in list] [prev in thread] [next in thread] 

List:       patchmanagement
Subject:    RE: QuickTime patch
From:       "Eric Schultze" <eric.schultze () shavlik ! com>
Date:       2007-01-26 18:00:56
Message-ID: B8C751C817821D4F87F01719532ABAF603942462 () Exchange3 ! shavlik ! com
[Download message RAW]

More:

If you have QuickTime installed, there is an option 'Help-Update
Existing Software'.  This does NOT update QuickTime 7.1.3 for the
security issue.  Instead, it says 'Your QuickTime software is up to
date.'  But it's not.

If when you installed QuickTime (or iTunes), you selected the option to
install the Apple Software Update tool, then a separate application is
installed on your system.  It is available via Start-All Programs-Apple
Software Update. 

I manually ran the Apple Software Update tool - it showed that I needed
an update to the Apple Software Update tool.  I did that, then ran it
again and it showed I needed an update for QuickTime 7.1.3.

Within the Apple Software Update tool, there is an option to download
the patch only and not install it.  The patch itself is called
SecurityUpdate2007-001.msi and no, it is *not* available for download
from the Apple website directly.

The SecurityUpdate2007-001.msi patch is 6.5 meg and updates three files
on your system:
QuickTimePlayer.exe    %ProgramFiles%\QuickTime           7.1.3.191
QuickTime.qts          %ProgramFiles%\QuickTime\QTSystem  7.1.3.191
QuickTimeStreaming.qtx %ProgramFiles%\QuickTime\QTSystem  7.1.3.191

Apple doesn't publish any information in their bulletin about what files
are updated, or how to check your system to see if it's been patched.
Therefore, you need to check it manually using the above details.

Keep in mind that the Help-Update Existing Software function within
QuickTime is oblivious to this patch, and that the patch itself can't be
downloaded from Apple's download page, no matter what the security
bulletin says (as least at this point in time).

Corporate folks may wish to install the QuickTime with Apple Software
Update tool on a VM machine, then run the Update tool to download the
actual MSI - then use your standard enterprise software deployment
mechanism to publish this MSI to anyone running 7.1.3 QuickTime.




-----Original Message-----
From: Eric Schultze [mailto:eric.schultze@shavlik.com] 
Sent: Friday, January 26, 2007 8:15 AM
To: Patch Management Mailing List
Subject: RE: QuickTime patch

Not so fast...  the article says it is available for Windows, but when
you click the link to the download page for this patch,
http://www.apple.com/support/downloads/securityupdate2007001universal.ht
ml, the downloadable patches for this issue are only available for OSX
and Panther, not Windows.

-----Original Message-----
From: Catlin, Kevin [mailto:Kevin.Catlin@cytec.com] 
Sent: Thursday, January 25, 2007 3:35 PM
To: Patch Management Mailing List
Subject: FW: QuickTime patch

The Apple article says it *is* available for Windows XP/2000:

"Available for: QuickTime 7.1.3 on Mac OS X v10.3.9, Mac OS X Server
v10.3.9, Mac OS X v10.4.8, Mac OS X Server v10.4.8, Windows XP/2000"

So my only beef is that I have to first install 7.1.3, then the patch
instead of just installing 7.1.4 (or something) and being done with it.

Kevin Catlin
Manager, Global Client Technologies
Cytec Industries Inc.
+1-973-357-3431
kevin.catlin@cytec.com

-----Original Message-----
From: Eric Schultze [mailto:eric.schultze@shavlik.com] 
Sent: Thursday, January 25, 2007 12:15 PM
To: Patch Management Mailing List
Subject: QuickTime patch

Apple has released a patch for QuickTime 7.1.3
More info here: http://docs.info.apple.com/article.html?artnum=304989
( I use the term 'more' loosely)

The security bulletin says that the patch is applicable to MacOSX and
Windows XP/2000 and says that it can be obtained in one of two ways:

1.  Download the patch from Apple Downloads
    (the downloadable patch is only for Mac OSX and isn't available for
Windows systems)

2. Use the Software Update mechanism within QuickTime (not installed by
default)

Downloading and installing new versions of QuickTime for Windows does
NOT include this fix.

IOW, there appears to be no standalone installer for this issue for
QuickTime on Windows, nor any easy way to patch QuickTime on Windows 

Hey Apple, how are corporate users supposed to update their Windows
systems for this issue?  Please consider either updating your full
Windows QuickTime install to include this fix, or release a standalone
windows installer.

Susan, another candidate for your list of vendors who just don't get
it...

---
When posting or replying to messages on this list, please send all
emails in plain text format.  HTML formatted messages will not be
accepted.

PatchManagement.org is hosted by Shavlik Technologies

To unsubscribe send a blank email to
leave-patchmanagement@patchmanagement.org
If you are unable to unsubscribe via this email address, please email
owner-patchmanagement@patchmanagement.org
</PRE>Legal Notice: This electronic communication, including any
attachments, contains information from Cytec Industries Inc. or its
subsidiaries that may be legally privileged, confidential, and exempt
from disclosure under applicable law.  If you are not the intended
recipient, any use or dissemination of this communication or its
attachment(s) is strictly prohibited and may be illegal.  If you have
received this communication in error, please notify the sender
immediately, destroy any printed copies and delete it from all computers
on which it may be stored.


---
When posting or replying to messages on this list, please send all
emails in plain text format.  HTML formatted messages will not be
accepted.

PatchManagement.org is hosted by Shavlik Technologies

To unsubscribe send a blank email to
leave-patchmanagement@patchmanagement.org
If you are unable to unsubscribe via this email address, please email
owner-patchmanagement@patchmanagement.org

---
When posting or replying to messages on this list, please send all
emails in plain text format.  HTML formatted messages will not be
accepted.

PatchManagement.org is hosted by Shavlik Technologies

To unsubscribe send a blank email to
leave-patchmanagement@patchmanagement.org
If you are unable to unsubscribe via this email address, please email
owner-patchmanagement@patchmanagement.org

---
When posting or replying to messages on this list, please send all
emails in plain text format.  HTML formatted messages will not be accepted.

PatchManagement.org is hosted by Shavlik Technologies

To unsubscribe send a blank email to leave-patchmanagement@patchmanagement.org
If you are unable to unsubscribe via this email address, please email
owner-patchmanagement@patchmanagement.org

[prev in list] [next in list] [prev in thread] [next in thread]