Avid addresses Apple QuickTime for Windows Security Issues

The industry was buzzing over Apples decision to stop supporting Apple Quicktime for Windows because of 2 new security threats. IT organizations have suggested removing Apple Quicktime for Windows from your computer. This can be problematic for video editors. Avid Knowledge Base: QuickTime Support and Security on Windows http://avid.force.com/pkb/articles/how_to/QuickTime-Support-and-Security-on-Windows Last Updated : April 26, 2016 What to do about the recommendations to uninstall QuickTime from Windows systems, and Avid's plan to remove dependencies on QuickTime libraries. Why are some people uninstalling QuickTime from their Windows systems and what should I do about it? This article provides guidance for Avid customers considering how best to react to the recent news of the cessation by Apple of support for QuickTime 7 for Windows, including the implications of uninstalling QuickTime libraries from their systems. Media Composer uses QuickTime libraries to import and export QuickTime files and link to QuickTime files using non-Avid QuickTime codecs. ProTools uses QuickTime to playback QuickTime files, bounce to MP3, and import certain audio files. Uninstalling QuickTime completely will prevent users from performing these actions. Avid is aware of the issues surrounding QuickTime support on Windows. We have been working on a solution and plan on releasing an update later this year to eliminate the dependencies on QuickTime libraries. Until then, we have identified potential workarounds to allow users to continue to use Media Composer and Pro Tools with QuickTime. While we believe that these workarounds may reduce security risks, Avid does not warrant that any Avid product is invulnerable to viruses or other risks. FAQ: Q: What information has Apple released about QuickTime on Windows? A: As of April 25, 2016, a statement is available on the Apple Support website stating that QuickTime 7 is no longer supported for Windows (article). The article does not address security issues related to this change. Q: Why has the US Department of Homeland Security recommended that users uninstall QuickTime from Windows systems? A: The US Department of Homeland Security recently released a statement recommending that users uninstall QuickTime from their Windows Systems. According to the statement, the US-CERT (United States Computer Emergency Readiness Team) has made this recommendation because Apple has stopped development for QuickTime on Windows, “leaving this software vulnerable to exploitation.” As of this posting, Avid is not aware of any serious security issues on QuickTime for Windows that would require a software update. Q: What is the risk of not removing QuickTime from a Windows system? A: As of this posting, Avid is aware of no confirmed security risks regarding QuickTime on Windows systems. Users should be cautious when downloading QuickTime files from the internet to ensure they are not downloading files with malicious code. Users should always only download files from known, trusted sources. Simply browsing the internet or using QuickTime files that have not been downloaded from the internet or other unknown sources should not pose a security threat. Q: What features or functions does Media Composer rely on QuickTime to perform? A: Media Composer relies on QuickTime for the following operations:

• File Import operations related to QT movies (in the supported QuickTime formats)
• The creation of QuickTime (.MOV) movies via the Export to File functionality
• Linking (AMA) to QuickTime files using Non-Avid codecs

Q: What happens if I uninstall QuickTime from my Media Composer Windows system? A: If QuickTime is not installed, Media Composer will function normally except for File Import, File Export and File Link (AMA) of Non-Avid QT movies (H264, .MP4). Media Composer will notify a user during the launch that QuickTime is not installed and some functionality may be missing. QuickTime files that use Avid Codecs, such as DNxHD, DNxHR, as well as ProRes, will Link and Play in the Media Composer application without QuickTime installed. A full list of the Avid codecs is available here. Q: What features or functions does ProTools rely on QuickTime to perform? A: ProTools relies on QuickTime for the following operations:

• Playback of QuickTime (.MOV) videos (MXF files are not affected)
• Bounce/Export to MP3 files
• Import of non WAV, AIFF, and MXF audio files. This includes but is not limited to MP3, AAC, and .MOV

Q: What happens if I uninstall QuickTime from my ProTools Windows system? A: If QuickTime is not installed, ProTools will function normally except playback of QuickTime videos, bounce/export to MP3 files, and import of audio files that are not WAV, AIFF, or MXF. Q: What is Avid’s plan to resolve this issue? A: Avid has been working on a solution to remove Media Composer's and Pro Tools' dependencies on Apple QuickTime libraries. We will be releasing an update later this year to accomplish this. This update will include support for:

• DNxHR and DNxHD
• ProRes
• H.264
• TIFF
• JPEG
• MP3
• AAC
• Uncompressed audio formats (PCM, ADPCM, etc.)

Additional codecs will be added in the following months. Please subscribe to this KB article to receive updated information as it becomes available. Temporary Solution: As a temporary solution, users may choose to uninstall QuickTime from their Windows system and reinstall it using a custom installation. While we believe that the following procedure will reduce the risk of security vulnerabilities, Avid does not warrant that any Avid product is invulnerable to viruses or other risks. Proceed at your own risk. Following this procedure will disable QuickTime integration with internet browsers and remove QuickTime player from your system, but Media Composer and ProTools should still work as expected. Important: You must install QuickTime following the below procedure BEFORE installing Media Composer. If you already have QuickTime and Media Composer installed, you will need to uninstall both before proceeding.

1. Uninstall QuickTime Player from your Windows system if you haven't already (also uninstall Media Composer if it's already installed)
2. Download and run the QuickTime player installer
3. Select “Custom Install”
4. Select “QuickTime Player” and “Entire feature will be unavailable”
5. The installer should look like this:
6. Select "Next" to complete the installation