ID

VAR-200903-0240

CVE

CVE-2009-0016

TITLE

Windows Work on Apple iTunes Denial of service in Japan (DoS) Vulnerability

DESCRIPTION

Apple iTunes before 8.1 on Windows allows remote attackers to cause a denial of service (infinite loop) via a Digital Audio Access Protocol (DAAP) message with a crafted Content-Length header. Apple iTunes is prone to an information-disclosure vulnerability and a denial-of-service vulnerability. Successfully exploiting these issues may allow an attacker to obtain sensitive information or cause the affected application to crash, denying service to legitimate users. Versions prior to Apple iTunes 8.1 are vulnerable.  Impact: ======= Denial of service.   Risk:  ===== Medium   Affected Software:  ================== Apple iTunes 8 for Windows, other versions may be affected  This issue does not affect Mac OS X systems References:  ===========  FortiGuard Advisory: http://www.fortiguardcenter.com/advisory/FGA-2009-11.html Apple Security Bulletin: http://support.apple.com/kb/HT3487  Apple Security Updates: http://support.apple.com/kb/ht1222  CVE ID: CVE-2009-0016  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0016  Acknowledgments:   ================ Xiaopeng Zhang, Zhenhua Liu, and Junfeng Jia of Fortinet's FortiGuard Global Security Research Team *** This email and any attachments thereto may contain private, confidential, and privileged material for the sole use of the intended recipient. Any review, copying, or distribution of this email (or any attachments thereto) by others is strictly prohibited. If you are not the intended recipient, please contact the sender immediately and permanently delete the original and any copies of this email and any attachments thereto. *** . ---------------------------------------------------------------------- Did you know? Our assessment and impact rating along with detailed information such as exploit code availability, or if an updated patch is released by the vendor, is not part of this mailing-list? Click here to learn more about our commercial solutions: http://secunia.com/advisories/business_solutions/ Click here to trial our solutions: http://secunia.com/advisories/try_vi/ ---------------------------------------------------------------------- TITLE: Apple iTunes Information Disclosure and Denial of Service SECUNIA ADVISORY ID: SA34254 VERIFY ADVISORY: http://secunia.com/advisories/34254/ DESCRIPTION: A vulnerability and a security issue have been reported in Apple iTunes, which can be exploited by malicious people to cause a DoS (Denial of Service) or to potentially disclose sensitive information. NOTE: The vulnerability does not affect Mac OS X systems. 2) An error in the implementation of the iTunes podcast feature can be exploited to entice a user into sending iTunes credentials to a podcast server via an authentication dialog presented when subscribing to a malicious podcast. The vulnerability and security issue are reported in version 8. SOLUTION: Update to version 8.1. PROVIDED AND/OR DISCOVERED BY: The vendor credits: 1) Xiaopeng Zhang, Zhenhua Liu, and Junfeng Jia of Fortinet's FortiGuard Global Security Research Team 2) Simon Bellwood ORIGINAL ADVISORY: http://support.apple.com/kb/HT3487 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

input validation

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Xiaopeng Zhang

SOURCES

LAST UPDATE DATE

2025-04-10T23:22:15.993000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE