Channel Register®

Original URL: http://www.channelregister.co.uk/2007/09/07/itunes_bug_patched/

Apple patches critical iTunes bug

Buffer overflow risk neutered

By SecurityFocus

Posted in Software & Security, 7th September 2007 10:15 GMT

Free whitepaper – Solid State Drives and High-Speed Memory

In all the hoopla surrounding Apple's announcement of its revamped line of iPods on Wednesday, many users might have missed the company's update to iTunes, which includes a fix for a serious security flaw.

The update, which brings the consumer technology company's iTunes music software to version 7.4 [1], adds the ability to turn previously bought music into ringtones and the ability to buy songs wirelessly using the iPhone and network-capable iPods. The update also patches a serious security vulnerability that could allow a specially-crafted music file to crash or take control of a victim's Windows PC or Mac, the company stated in an advisory [2].

"A buffer overflow exists in iTunes when processing album cover art," the company stated. "By enticing a user to open a maliciously crafted music file, an attacker may trigger the overflow which may lead to an unexpected application termination or arbitrary code execution."

Apple has patched more than 100 vulnerabilities [3] in its Mac OS X operating system and applications this year. Many security researchers and hackers have begun to focus [4] on the consumer technology company's latest mobile device, the iPhone, which received it first patch [5] in July.

Apple credited iSEC Partners [6] with the discovery of the vulnerability.

A nod to ZDNet's Zero Day blog [7].

This article originally appeared in Security Focus [8].

Copyright © 2007, SecurityFocus [9]