Apple iTunes CoreAudio (CVE-2011-3252) Buffer Overflow Vulnerability

Bugtraq ID:	50065
Class:	Boundary Condition Error
CVE:	CVE-2011-3252
Remote:	Yes
Local:	No
Published:	Oct 11 2011 12:00AM
Updated:	Mar 19 2015 09:27AM
Credit:	<br>Luigi Auriemma working with TippingPoint's Zero Day Initiative
Vulnerable:	Apple Mac OS X Server 10.6.6 Apple Mac OS X Server 10.6.5 Apple Mac OS X Server 10.6.4 Apple Mac OS X Server 10.6.3 Apple Mac OS X Server 10.6.2 Apple Mac OS X Server 10.6.1 Apple Mac Os X Server 10.6.8 Apple Mac Os X Server 10.6.7 Apple Mac OS X Server 10.6 Apple Mac OS X 10.6.5 Apple Mac OS X 10.6.4 Apple Mac OS X 10.6.3 Apple Mac OS X 10.6.2 Apple Mac OS X 10.6.1 Apple Mac OS X 10.6 Apple iTunes 9.2.1 Apple iTunes 9.0.2 Apple iTunes 9.0.1 .8 Apple iTunes 9.0.1 Apple iTunes 9.0 Apple iTunes 9.2 Apple iTunes 9.1 Apple iTunes 8.2 Apple iTunes 8.1 Apple iTunes 8.0.2.20 Apple iTunes 8.0 Apple iTunes 10.2.2 Apple iTunes 10.2 Apple iTunes 10.1 Apple iTunes 10
Not Vulnerable:	Apple iTunes 10.5

Apple iTunes CoreAudio (CVE-2011-3252) Buffer Overflow Vulnerability

Apple iTunes is prone to a buffer-overflow vulnerability that affects the CoreAudio component.

Successful exploits may allow attackers to execute arbitrary code within the context of the application. Failed exploit attempts will likely result in a denial-of-service condition.

Apple iTunes CoreAudio (CVE-2011-3252) Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apple iTunes CoreAudio (CVE-2011-3252) Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references for more details.


Apple iTunes 10.2

• Apple APPLE-SA-2011-10-11-1 iTunes64Setup.exe
  For 64-bit Windows XP / Vista / Windows 7
  http://www.apple.com/itunes/download/


• Apple APPLE-SA-2011-10-11-1 iTunesSetup.exe
  For Windows XP / Vista / Windows 7
  http://www.apple.com/itunes/download/

Apple iTunes 10.1

• Apple APPLE-SA-2011-10-11-1 iTunes64Setup.exe
  For 64-bit Windows XP / Vista / Windows 7
  http://www.apple.com/itunes/download/


• Apple APPLE-SA-2011-10-11-1 iTunesSetup.exe
  For Windows XP / Vista / Windows 7
  http://www.apple.com/itunes/download/

Apple Mac Os X Server 10.6.8

• Apple SecUpdSrvr2012-001.dmg
  For Mac OS X Server v10.6.8
  http://www.apple.com/support/downloads/

Apple iTunes 10.2.2

• Apple APPLE-SA-2011-10-11-1 iTunes64Setup.exe
  For 64-bit Windows XP / Vista / Windows 7
  http://www.apple.com/itunes/download/


• Apple APPLE-SA-2011-10-11-1 iTunesSetup.exe
  For Windows XP / Vista / Windows 7
  http://www.apple.com/itunes/download/

Apple iTunes 10

• Apple APPLE-SA-2011-10-11-1 iTunes64Setup.exe
  For 64-bit Windows XP / Vista / Windows 7
  http://www.apple.com/itunes/download/


• Apple APPLE-SA-2011-10-11-1 iTunesSetup.exe
  For Windows XP / Vista / Windows 7
  http://www.apple.com/itunes/download/

Apple iTunes CoreAudio (CVE-2011-3252) Buffer Overflow Vulnerability

References:

• About the security content of iTunes 10.5 (Apple)
  
• Mac OS X Homepage (Apple)
  
• APPLE-SA-2011-10-11-1 iTunes 10.5 ([email protected])
  
• ZDI-11-304 Apple Quicktime Advanced Audio Codec Frame Parsing Remote Code Execut (Zero Day Initiative)