Apple iTunes 6 For Windows Arbitrary Local Code Execution Vulnerability

Bugtraq ID:	15446
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Nov 15 2005 12:00AM
Updated:	Nov 15 2005 12:00AM
Credit:	Discovery is credited to an anonymous source.
Vulnerable:	Apple iTunes 5.0
Not Vulnerable:	Apple iTunes 6.0

Apple iTunes 6 For Windows Arbitrary Local Code Execution Vulnerability

Apple iTunes 6 for Windows is prone to an arbitrary local code execution vulnerability.

This is due to a design error in which malicious code may be executed in the context of the user running the affected application.

Apple iTunes 6 For Windows Arbitrary Local Code Execution Vulnerability

No exploit is required.

Apple iTunes 6 For Windows Arbitrary Local Code Execution Vulnerability

Solution:
Apple has released version iTunes version 6 to address this issue.


Apple iTunes 5.0

• Apple iTunesSetup.exe
  http://www.apple.com/itunes/download/iTunesSetup.exe

Apple iTunes 6 For Windows Arbitrary Local Code Execution Vulnerability

References:

• Apple security updates (Apple)
  
• Vendor Home Page (Apple)
  
• iDEFENSE Security Advisory 11.15.05: Multiple Vendor Insecure Call ("[email protected]" )