Apple iTunes Log File Insecure File Operation Local Privilege Escalation Vulnerability

Bugtraq ID:	42538
Class:	Design Error
CVE:	CVE-2010-1768
Remote:	No
Local:	Yes
Published:	Aug 12 2010 12:00AM
Updated:	Aug 12 2010 12:00AM
Credit:	Jon Passki, and Nicolas Seriot of HEIG-VD
Vulnerable:	Apple iTunes 9.0.2 Apple iTunes 9.0.1 .8 Apple iTunes 9.0.1 Apple iTunes 9.0 Apple iTunes 7.3.2 Apple iTunes 7.3.1 Apple iTunes 7.3 Apple iTunes 7.0.2 Apple iTunes 8.2 Apple iTunes 8.1 Apple iTunes 8.0.2.20 Apple iTunes 8.0 Apple iTunes 7.4
Not Vulnerable:	Apple iTunes 9.1

Apple iTunes Log File Insecure File Operation Local Privilege Escalation Vulnerability

Apple iTunes is prone to a local privilege-escalation vulnerability.

Successfully exploiting this issue may allow an attacker to execute arbitrary code with superuser privileges.

Versions prior to Apple iTunes 9.1 on Apple Mac OS X are vulnerable.

Apple iTunes Log File Insecure File Operation Local Privilege Escalation Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent
information, please mail us at: [email protected].

Apple iTunes Log File Insecure File Operation Local Privilege Escalation Vulnerability

Solution:
The vendor has released an update. Please see the references for more information.

Apple iTunes Log File Insecure File Operation Local Privilege Escalation Vulnerability

References:

• About the security content of iTunes 9.1 (Apple)
  
• iTunes Homepage (Apple)