Apple iTunes Information Disclosure and Denial of Service Vulnerabilities

Bugtraq ID:	34094
Class:	Unknown
CVE:	CVE-2009-0016 CVE-2009-0143
Remote:	Yes
Local:	No
Published:	Mar 11 2009 12:00AM
Updated:	Mar 13 2009 02:46PM
Credit:	Xiaopeng Zhang, Zhenhua Liu, Junfeng Jia, and Simon Bellwood
Vulnerable:	Apple iTunes 7.3.2 Apple iTunes 7.3.1 Apple iTunes 7.3 Apple iTunes 7.0.2 Apple iTunes 8.0.2.20 Apple iTunes 8.0 Apple iTunes 7.4
Not Vulnerable:	Apple iTunes 8.1

Apple iTunes Information Disclosure and Denial of Service Vulnerabilities

Apple iTunes is prone to an information-disclosure vulnerability and a denial-of-service vulnerability.

Successfully exploiting these issues may allow an attacker to obtain sensitive information or cause the affected application to crash, denying service to legitimate users.

Versions prior to Apple iTunes 8.1 are vulnerable.

Apple iTunes Information Disclosure and Denial of Service Vulnerabilities

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apple iTunes Information Disclosure and Denial of Service Vulnerabilities

Solution:
The vendor has released an update. Please see the references for more information.

Apple iTunes Information Disclosure and Denial of Service Vulnerabilities

References:

• Apple iTunes DAAP Message Handling Denial of Service Vulnerability (Fortinet)
  
• iTunes Homepage (Apple)
  
• Apple iTunes DAAP Messages Handling Denial of Service Vulnerability (Fortinet)
  
• Apple iTunes DAAP Messages Handling Denial of Service Vulnerability ("[email protected]" )
  
• About the security content of iTunes 8.1 (Apple)