Apple iTunes AAC File Parsing Integer Overflow Vulnerability

Bugtraq ID:	18730
Class:	Boundary Condition Error
CVE:	CVE-2006-1467
Remote:	Yes
Local:	No
Published:	Jun 29 2006 12:00AM
Updated:	Jun 30 2006 09:09PM
Credit:	ATmaCA working with TippingPoint and the Zero Day Initiative are credited with the discovery of this vulnerability.
Vulnerable:	eSignal eSignal 6.0.2 Apple iTunes 6.0.4 Apple iTunes 6.0.3 Apple iTunes 6.0.1 Apple iTunes 6.0 Apple iTunes 5.0 Apple iTunes 4.8 Apple iTunes 4.7.1 Apple iTunes 4.7 Apple iTunes 4.6 Apple iTunes 4.5 Apple iTunes 4.2 .72
Not Vulnerable:	Apple iTunes 6.0.5

Apple iTunes AAC File Parsing Integer Overflow Vulnerability

iTunes is prone to an integer-overflow vulnerability.

An attacker may exploit this issue to execute arbitrary code with the privileges of the user that activated the vulnerable application. This may help the attacker gain unauthorized access or escalate privileges.

Apple iTunes AAC File Parsing Integer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

Apple iTunes AAC File Parsing Integer Overflow Vulnerability

Solution:
The vendor has released version 6.0.5 to address this issue.mailto:[email protected]


Apple iTunes 6.0

• Apple iTunes6.0.5.dmg
  For Mac OS X
  http://www.apple.com/itunes/download/


• Apple iTunesSetup.exe
  For Windows 2000 or XP
  http://www.apple.com/itunes/download/

Apple iTunes 6.0.1

• Apple iTunes6.0.5.dmg
  For Mac OS X
  http://www.apple.com/itunes/download/


• Apple iTunesSetup.exe
  For Windows 2000 or XP
  http://www.apple.com/itunes/download/

eSignal eSignal 6.0.2

• Apple iTunes6.0.5.dmg
  For Mac OS X
  http://www.apple.com/itunes/download/


• Apple iTunesSetup.exe
  For Windows 2000 or XP
  http://www.apple.com/itunes/download/

Apple iTunes 6.0.3

• Apple iTunes6.0.5.dmg
  For Mac OS X
  http://www.apple.com/itunes/download/


• Apple iTunesSetup.exe
  For Windows 2000 or XP
  http://www.apple.com/itunes/download/

Apple iTunes 6.0.4

• Apple iTunes6.0.5.dmg
  For Mac OS X
  http://www.apple.com/itunes/download/


• Apple iTunesSetup.exe
  For Windows 2000 or XP
  http://www.apple.com/itunes/download/

Apple iTunes AAC File Parsing Integer Overflow Vulnerability

References:

• Apple Downloads (Apple)
  
• iTunes Homepage (Apple)
  
• ZDI-06-020: Apple iTunes AAC File Parsing Integer Overflow Vulnerability (ZeroDay Initiative)