iTunes flaw could enable malicious code

Apple has fixed a critical hole that attackers could exploit to launch malicious code on PCs, including corporate clients, running the popular music software.

Apple Computer Inc. has patched a flaw attackers could potentially exploit in the popular iTunes music program to cause a denial of service or launch malicious code on victims' machines.

According to the company's advisory, the AAC file-parsing code in iTunes versions prior to 6.0.5 contains an integer overflow vulnerability. "Parsing a maliciously-crafted AAC file could cause iTunes to terminate or potentially execute arbitrary code," Apple said.

The company added that iTunes 6.0.5 addresses the problem by improving the validation checks used when loading AAC files.

Danish vulnerability clearinghouse Secunia rated the iTunes flaw highly critical because attackers could exploit it from remote locations.

This is the second security update Apple has released in the last week. Tuesday, the company released Mac OS X version 10.4.7 to address multiple security holes in the operating system.

Dig deeper on Application Attacks (Buffer Overflows, Cross-Site Scripting)

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

-ADS BY GOOGLE

SearchCloudSecurity

SearchNetworking

SearchCIO

SearchConsumerization

SearchEnterpriseDesktop

SearchCloudComputing

ComputerWeekly

Close