Hi @ll, the just released QuickTime 7.7.6 and iTunes 12.0.1 for Windows still have quite some of the beginners errors I documented in <http://seclists.org/fulldisclosure/2014/Aug/33> and <http://seclists.org/fulldisclosure/2014/Aug/44> QuickTime 7.7.6: [HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Media\QuickTime\shell\open\command] @="C:\\Program Files\\QuickTime\\QuickTimePlayer.exe" iTunes 12.0.1: [HKEY_CLASSES_ROOT\daap\shell\open\command] @="C:\\Program Files\\...\\iTunes.exe /url \"%1\"" [HKEY_CLASSES_ROOT\itls\shell\open\command] @="C:\\Program Files\\...\\iTunes.exe /url \"%1\"" [HKEY_CLASSES_ROOT\itms\shell\open\command] @="C:\\Program Files\\...\\iTunes.exe /url \"%1\"" [HKEY_CLASSES_ROOT\itmss\shell\open\command] @="C:\\Program Files\\...\\iTunes.exe /url \"%1\"" [HKEY_CLASSES_ROOT\itpc\shell\open\command] @="C:\\Program Files\\...\\iTunes.exe /url \"%1\"" [HKEY_CLASSES_ROOT\itsradio\shell\open\command] @="C:\\Program Files\\...\\iTunes.exe /url \"%1\"" [HKEY_CLASSES_ROOT\itunesradio\shell\open\command] @="C:\\Program Files\\...\\iTunes.exe /url \"%1\"" [HKEY_CLASSES_ROOT\iTunes\shell\open\command] @="C:\\Program Files\\...\\iTunes.exe /url \"%1\"" [HKEY_CLASSES_ROOT\iTunes.AssocProtocol.daap\shell\open\command] @="C:\\Program Files\\...\\iTunes.exe /url \"%1\"" [HKEY_CLASSES_ROOT\iTunes.AssocProtocol.itls\shell\open\command] @="C:\\Program Files\\...\\iTunes.exe /url \"%1\"" [HKEY_CLASSES_ROOT\iTunes.AssocProtocol.itms\shell\open\command] @="C:\\Program Files\\...\\iTunes.exe /url \"%1\"" [HKEY_CLASSES_ROOT\iTunes.AssocProtocol.itmss\shell\open\command] @="C:\\Program Files\\...\\iTunes.exe /url \"%1\"" [HKEY_CLASSES_ROOT\iTunes.AssocProtocol.itpc\shell\open\command] @="C:\\Program Files\\...\\iTunes.exe /url \"%1\"" [HKEY_CLASSES_ROOT\iTunes.AssocProtocol.pcast\shell\open\command] @="C:\\Program Files\\...\\iTunes.exe /url \"%1\"" [HKEY_CLASSES_ROOT\pcast\shell\open\command] @="C:\\Program Files\\...\\iTunes.exe /url \"%1\"" [HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Media\iTunes\shell\open\command] @="C:\\Program Files\\...\\iTunes.exe" Also, QuickTime 7.7.6 comes with version 2.3.6 of Apple's application support, while iTunes 12.0.1 comes with version 3.1 of this package. While the older version 2.3.6 properly quotes the command lines in [HKEY_CLASSES_ROOT\CLSID\{fdd068c2-d51a-4175-8a20-5cbc704ea3bd}\LocalServer32] @="\"C:\\Program Files\\...\\APSDaemon.exe\"" [HKEY_CLASSES_ROOT\CLSID\{6812639B-FD61-4329-9901-22CFDBD690FE}\LocalServer32] @="\"C:\\Program Files\\...\\APSDaemon.exe\"" the newer version 3.1 does not: [HKEY_CLASSES_ROOT\CLSID\{fdd068c2-d51a-4175-8a20-5cbc704ea3bd}\LocalServer32] @="C:\\Program Files\\...\\APSDaemon.exe" [HKEY_CLASSES_ROOT\CLSID\{6812639B-FD61-4329-9901-22CFDBD690FE}\LocalServer32] @="C:\\Program Files\\...\\APSDaemon.exe" [HKEY_CLASSES_ROOT\CLSID\{D9E904CA-8865-42E7-B0F0-B7B8C4D54D70}\LocalServer32] @="C:\\Program Files\\...\\APSDaemon.exe" Additionally, application support 3.1 contains outdated and vulnerable version 10.0.40219.1 of MSVCR100.DLL and MSVCP100.DLL Cf. <http://support.microsoft.com/kb/24671743> and <http://support.microsoft.com/kb/2565063> alias <http://www.microsoft.com/technet/security/bulletin/ms11-025> Will Apple's developers and their QA EVER learn how to use filenames with embedded spaces properly? regards Stefan Kanthak
