Apple iTunes Playlist Handling Buffer Overflow Vulnerability

[Nomad559]

Apple iTunes Playlist Handling Buffer Overflow Vulnerability

http://secunia.com/advisories/13804

Highly critical

Software: iTunes 4.x

Description:
Sean de Regge has reported a vulnerability in iTunes, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error within the handling of .m3u and .pls playlists. This can be exploited to cause a buffer overflow via a specially crafted playlist containing an overly long URL.

Successful exploitation may allow execution of arbitrary code.

Solution:
Update to version 4.7.1.
http://www.apple.com/support/downloads/itunes471.html


http://secunia.com

[Deja Q]

1. What? You mean Macs aren't immune to the script kiddies?

ROTFLMAO. I've known that for years. ANYTHING can be exploited. The reason why many don't is because the Mac is down to 0.5% in the market.

If the Mac had even 5% of the market like Linux does in the server area (LOL, that figure was from 1998 and the amount since then has rather increased, with Linux potentially set to replace Windows in the next 6~7 years), you can bet your sweet bippy that Macs would be targeted too. (Mac zealots who claim Macs are invulnerable are almost entertaining when they do their song and dance about their computers being so perfect.)

[ET Awful]

2. I was just thinking the same thing :)

Hehehe. . . Apple is invulnerable man. . . this just can't be.

It's jsut another sign of the pending apocalypse man.

:evilgrin:

[DS1]

3. I just saw a Mac User making two little slips

A) He's on the latest patch of OS X, which contridicts the "XP has too many patches" argument

B) He's not going to "hold Apple responsible for a funky third party driver" which had crashed his machine, so when it does crash it's not Apple's fault.

[ET Awful]

4. OF course, using argument B . . .

Most of the problems he tries to attributed to Windows aren't the fault of Microsoft, as all are third party programs. So malware, since it is not written by Microsoft, can't be blamed on them using his logic. Same with third party drivers for SCSI cards, graphics cards and the like.

So, using his argument, Windows is completely problem free.

[DS1]

16. Which is what ~he~ was saying

but not seeing it due to the trees ;-)

[chenGOD]

7. Umm please note that this affects the Windows OS

as well as the Mac OS.
And there is a fix available for it right away.
Of course no OS is totally secure, but I would wager that OS X is much more secure than XP.

[benburch]

8. Actually, this means they are immune.

Launch iTunes. It will tell you to update to the new version immediately.

A skript kid would have to strike in the tiny window between the vulnerability being shown and the vast majority of systems being updated. Also, he would need to be smart enough to manage Power PC machine code, which they are not.

So, this door was being closed before you ever heard about it, and even if it had not, there are no virus writing kits for a skript kid to abuse.

Sorry, it will be a cold day in hell before there is even 1% of the virus and worm problem on the mac that there is on Whinedows.

[Commie Pinko Dirtbag]

10. Very similar to the way things happen in Linux. Of course, they're both

Unix variants.

[Name removed]

5. Deleted message

Message removed by moderator. Click here to review the message board rules.

[Name removed]

6. Deleted message

Message removed by moderator. Click here to review the message board rules.

[Commie Pinko Dirtbag]

9. CRAP! Late to the party AGAIN!

Isn't it odd that not even Linux vs. Windows flamewars elicit deleted messages until Apple is involved? And they say WE are religious. Feh.

[benburch]

11. I dunno what sets those Windows guys off over Apple???

Do you have any ideas?

I try to be polite by they cannot even admit simple things like the facts that there are 100,000+ known Windows viruses, and less than 100 for all versions of Mac OS, and ONE for any version of Mac OSX (and which won't work on an up to date system).

In contrast I get along fine with Linux folks, and BSD folks, and Amiga folks, and VAX/VMS folks... None of this hyperbolic trashing of the Mac platform.

[Commie Pinko Dirtbag]

12. About the only thing Linux users will say bad about Apple is

"This hardware is too expensive for its specs." Which is an undeniable truth. But, other than that, Macs are a-OK by me.

[benburch]

13. I agree with that.

But feel that the software is enough of an advantage to cover the maybe 10% premium.

[benburch]

14. Oh, I was meaning to ask you a Linux Question...

If you were going to rent a server in a remote place, would you rather it were RedHat, or Debian? I may need to make that choice this week.

[Commie Pinko Dirtbag]

15. Red Hat. Personal taste.

I find it to have the best combination of up-to-dateness and stability. The third party repositories are also better cared for. May I ask what company is it? PM me if you don't want it to be public.

[slutticus]

17. Shit. Thanks for posting this.

I was kinda procrastinating on the updating of my iTunes version.