Apple released Apple TV 1.1 Software to implement YouTube.com Access and fix Security Issue

Apple released an update to the Apple TV's software to version 1.1. It is available only via the Apple TV's software update function and is not (yet) available as a separate stand-alone updater. Version 1.1 allows one to easily navigate through YouTube's familiar video browsing categories or search for specific videos. YouTube members can also log-in to their YouTube accounts on Apple TV to view and save their favorite videos.

The security issue is:

CVE-2007-2386--A remote attacker may be able to cause a denial of service or arbitrary code execution. A buffer overflow vulnerability exists in the UPnP IGD (Internet Gateway Device Standardized Device Control Protocol) code used to create Port Mappings on home NAT gateways in the Apple TV implementation. By sending a maliciously crafted packet, a remote attacker can trigger the overflow which may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation when processing UPnP protocol packets. Credit to Michael Lynn of Juniper Networks for reporting this issue.

[Bill Fox]