iTunes flaw could enable malicious code

Article

iTunes flaw could enable malicious code

Apple Computer Inc. has patched a flaw attackers could potentially exploit in the popular iTunes music program to cause a denial of service or launch malicious code on victims' machines.

According to the company's advisory, the

    Requires Free Membership to View

    Login

    SearchSecurity.co.UK members gain immediate and unlimited access to breaking UK industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.co.UK today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.co.uk you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.co.uk is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

AAC file-parsing code in iTunes versions prior to 6.0.5 contains an integer overflow vulnerability. "Parsing a maliciously-crafted AAC file could cause iTunes to terminate or potentially execute arbitrary code," Apple said.

The company added that iTunes 6.0.5 addresses the problem by improving the validation checks used when loading AAC files.

Danish vulnerability clearinghouse Secunia rated the iTunes flaw highly critical because attackers could exploit it from remote locations.

This is the second security update Apple has released in the last week. Tuesday, the company released Mac OS X version 10.4.7 to address multiple security holes in the operating system.