CSIRTUK advisories

ID: 3892
Date: 23/09/2009

---

Title: 3892 - APPLE-SA-2009-09-22-1 iTunes 9.0.1
Platform level affected:Office Application
Specific operating systems components affected: 32-bit Windows
Remediation Summary:Update your copy of the software with the download available from the supplier.
Vendors affected:Apple
Applications affected:iTunes
Adversity source: Unknown
Attack Vector: Vulnerability exploitation
Virulence: Unknown
Warning Status: Unknown
Potential Damage: Remote execution/modification
Possible Duration: Unknown
Availability of fix: Available
Type of fix: Patch
Source: Apple
Reliability of source: Trusted
Source URL: http://www.apple.com/itunes/download/
Abstract: Apple has released iTunes 9.0.1 addressing a vulnerability that may lead to an unexpected application termination or arbitrary code execution.

APPLE-SA-2009-09-22-1 iTunes 9.0.1

iTunes 9.0.1 is now available and addresses the following:

iTunes
CVE-ID:  CVE-2009-2817
Available for:  Mac OS X v10.4.11 or later, Mac OS X Server v10.4.11 or later, Windows XP, Vista, Windows 7
Impact:  Opening a maliciously crafted .pls file may lead to an unexpected application termination or arbitrary code execution
Description:  A buffer overflow exists in the handling of .pls files.
Opening a maliciously crafted .pls file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Credit to Roger Hart of IP3, and Steven Woolley at Oogli LLC for reporting this issue.

iTunes 9.0.1 may be obtained from:
http://www.apple.com/itunes/download/

For Mac OS X:
The download file is named: "iTunes9.0.1.dmg"
Its SHA-1 digest is: eea9dbc34e395a44bfa821501827ea3c5b4c24a9

For Windows XP / Vista / Windows 7:
The download file is named: "iTunesSetup.exe"
Its SHA-1 digest is: 25d04ff5a63a808ca56875cdf9a9474b9b845f1d

For 64-bit Windows XP / Vista / Windows 7:
The download file is named: "iTunes64Setup.exe"
Its SHA-1 digest is: 85f8c516cb45024292cde1f48e88fd392e25626f

Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222

 

This advisory contains information released by the original author. Some of the information may have changed since it was released. If the issue affects you, it may be prudent to retrieve the advisory from the site of the original source to ensure that you receive the most current information concerning that problem. Reference to any specific commercial product, process, or service by trade name, trademark manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favouring by CPNI.

The views and opinions of authors expressed within this notice shall not be used for advertising or product endorsement purposes. CPNI shall not accept responsibility for any errors or omissions contained within this advisory. In particular, they shall not be liable for any loss or damage whatsoever, arising from or in connection with the usage of information contained within this advisory.

CSIRTUK is a member of the Forum of Incident Response and Security Teams (FIRST) and has contacts with other international Incident Response Teams (IRTs) in order to foster cooperation and coordination in incident prevention, to prompt rapid reaction to incidents, and to promote information sharing amongst its members and the community at large.