Sign-up

ID

VAR-201309-0046


CVE

CVE-2013-1035


TITLE

Apple iTunes of iTunes ActiveX Vulnerability in arbitrary code execution in control

Trust: 0.8

sources: JVNDB: JVNDB-2013-004212

DESCRIPTION

The iTunes ActiveX control in Apple iTunes before 11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. Failed exploit attempts will likely result in denial-of-service conditions. Versions prior to Apple iTunes 11.1 are vulnerable. Apple iTunes is a set of media player applications of Apple (Apple), which is mainly used for playing and managing digital music and video files. This issue was addressed through additional bounds checking. CVE-ID CVE-2013-1035 : Honggang Ren of Fortinet's FortiGuard Labs iTunes 11.1 may be obtained from: http://www.apple.com/itunes/download/ For Windows XP / Vista / Windows 7: The download file is named: "iTunesSetup.exe" Its SHA-1 digest is: cef0f1398e1d51fd2f832c12763c2bf1627379ee For 64-bit Windows XP / Vista / Windows 7: The download file is named: "iTunes64Setup.exe" Its SHA-1 digest is: 5efe95a1f1df32f3833e5972db02e37ca7bfc43d Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJSOcZEAAoJEPefwLHPlZEwoVMP/1EOonGp47xN2EPt4mLGxDCS nK0aan5a29OGwGOvZHKejjbTJcoIRiovdjEUGvssjUYGZ26FQ2O0+54b0xrGRZDA c9WLR9fFLcjeYTOzo6Exx7qCxw+/RxbA1+MRcrmavjoaH+vzDAEvjoMSu6l4FKIO inkrZQ85o8XyJByZ2RonJPICEVVGXGbDO/0C3/r16Vxcc0LHmX6nZCNv98IltYIz AQ67ndSXkBA2nvRykKaTA7CLzxqEdiwqlcli50HsMEfhod4aMiqiS9l2Qlm3NLEn E31Vep2eM4dIB1b3yPhnJfgu1059AVaMAHL2f4kkaK8qx2wuHJN7zMBCXxhEYpx2 X60w3Y8x7kxdMEDFj+4MivuF/9+G5Kl+/E/S1LCs/iJDf0xt6Uip2GufLEPOuJpe 0mqtdGoXfc/nz0xq4p1LMApjuZG4Wo6vuq7mwOWF7uD8o2OgZ5SC7+vsz9mTvLi8 3w88EP2X9/qhHuwVBF9CwWhp7s/wRLJ49i+6bgYuIZQsHHQ45KfEdpAhFv4p+BkM AfEGdAuDrpTqyAxvyvto2pgub9a0WLVD2T/jC/e8GC3Ad73KaoD8+nwLQnyARSId Vu4wyZ0jiLz8TycEby9Xn0PlqJ9fUJdHKM+lfRom6VwjF2/6y3LiWuyCl3nESXa9 FtwVmY6yJgOVNzjJyR3F =+8pY -----END PGP SIGNATURE-----

Trust: 2.07

sources: NVD: CVE-2013-1035 // JVNDB: JVNDB-2013-004212 // BID: 62486 // VULHUB: VHN-61037 // PACKETSTORM: 123300

AFFECTED PRODUCTS

vendor:applemodel:itunesscope:eqversion:11.0.1

Trust: 1.6

vendor:applemodel:itunesscope:eqversion:11.0.2

Trust: 1.6

vendor:applemodel:itunesscope:eqversion:11.0.4

Trust: 1.6

vendor:applemodel:itunesscope:eqversion:11.0

Trust: 1.6

vendor:applemodel:itunesscope:eqversion:11.0.3

Trust: 1.6

vendor:applemodel:itunesscope:lteversion:11.0.5

Trust: 1.0

vendor:applemodel:itunesscope:ltversion:11.1 (windows)

Trust: 0.8

vendor:applemodel:itunesscope:eqversion:11.0.5

Trust: 0.6

vendor:applemodel:itunesscope:eqversion:10.5.1

Trust: 0.3

vendor:applemodel:itunesscope:eqversion:10.6

Trust: 0.3

vendor:applemodel:itunesscope:eqversion:10.5

Trust: 0.3

vendor:applemodel:itunesscope:eqversion:10.2.2

Trust: 0.3

vendor:applemodel:itunesscope:eqversion:10.2

Trust: 0.3

vendor:applemodel:itunesscope:eqversion:10.1

Trust: 0.3

vendor:applemodel:itunesscope:eqversion:10

Trust: 0.3

sources: BID: 62486 // JVNDB: JVNDB-2013-004212 // CNNVD: CNNVD-201309-308 // NVD: CVE-2013-1035

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2013-1035
value: HIGH

Trust: 1.0

NVD: CVE-2013-1035
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201309-308
value: CRITICAL

Trust: 0.6

VULHUB: VHN-61037
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2013-1035
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-61037
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-61037 // JVNDB: JVNDB-2013-004212 // CNNVD: CNNVD-201309-308 // NVD: CVE-2013-1035

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.9

sources: VULHUB: VHN-61037 // JVNDB: JVNDB-2013-004212 // NVD: CVE-2013-1035

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201309-308

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-201309-308

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2013-004212

PATCH
title:APPLE-SA-2013-09-18-1url:http://lists.apple.com/archives/security-announce/2013/Sep/msg00005.html
Trust: 0.8
title:HT5936url:http://support.apple.com/kb/HT5936
Trust: 0.8
title:HT5936url:http://support.apple.com/kb/HT5936?viewlocale=ja_JP
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2013-004212

EXTERNAL IDS
db:NVDid:CVE-2013-1035
Trust: 2.9
db:JVNid:JVNVU90838310
Trust: 0.8
db:JVNDBid:JVNDB-2013-004212
Trust: 0.8
db:CNNVDid:CNNVD-201309-308
Trust: 0.7
db:APPLEid:APPLE-SA-2013-09-18-1
Trust: 0.6
db:BIDid:62486
Trust: 0.4
db:PACKETSTORMid:123300
Trust: 0.2
db:SEEBUGid:SSVID-61043
Trust: 0.1
db:VULHUBid:VHN-61037
Trust: 0.1
sources:
            
            
            VULHUB: VHN-61037 // 
            
            
            
            BID: 62486 // 
            
            
            
            JVNDB: JVNDB-2013-004212 // 
            
            
            
            PACKETSTORM: 123300 // 
            
            
            
            CNNVD: CNNVD-201309-308 // 
            
            
            
            NVD: CVE-2013-1035

REFERENCES
url:http://lists.apple.com/archives/security-announce/2013/sep/msg00005.html
Trust: 1.7
url:http://support.apple.com/kb/ht5936
Trust: 1.7
url:https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a18997
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-1035
Trust: 0.8
url:http://jvn.jp/cert/jvnvu90838310/index.html
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-1035
Trust: 0.8
url:http://support.microsoft.com/kb/240797
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2013-1035
Trust: 0.1
url:https://www.apple.com/support/security/pgp/
Trust: 0.1
url:http://support.apple.com/kb/ht1222
Trust: 0.1
url:http://www.apple.com/itunes/download/
Trust: 0.1
url:http://gpgtools.org
Trust: 0.1
sources:
            
            
            VULHUB: VHN-61037 // 
            
            
            
            BID: 62486 // 
            
            
            
            JVNDB: JVNDB-2013-004212 // 
            
            
            
            PACKETSTORM: 123300 // 
            
            
            
            CNNVD: CNNVD-201309-308 // 
            
            
            
            NVD: CVE-2013-1035

CREDITS
Honggang Ren of Fortinet's FortiGuard Labs
Trust: 0.3
sources:
            
            
            BID: 62486

SOURCES
db:VULHUBid:VHN-61037
db:BIDid:62486
db:JVNDBid:JVNDB-2013-004212
db:PACKETSTORMid:123300
db:CNNVDid:CNNVD-201309-308
db:NVDid:CVE-2013-1035

LAST UPDATE DATE
2025-04-11T23:05:35.933000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-61037date:2017-09-19T00:00:00
db:BIDid:62486date:2013-09-18T00:00:00
db:JVNDBid:JVNDB-2013-004212date:2013-09-24T00:00:00
db:CNNVDid:CNNVD-201309-308date:2013-09-22T00:00:00
db:NVDid:CVE-2013-1035date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:VULHUBid:VHN-61037date:2013-09-19T00:00:00
db:BIDid:62486date:2013-09-18T00:00:00
db:JVNDBid:JVNDB-2013-004212date:2013-09-24T00:00:00
db:PACKETSTORMid:123300date:2013-09-18T18:21:10
db:CNNVDid:CNNVD-201309-308date:2013-09-22T00:00:00
db:NVDid:CVE-2013-1035date:2013-09-19T10:27:55.647