About the security content of iTunes 8.1

This document describes the security content of iTunes 8.1.

For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website.

For information about the Apple Product Security PGP Key, see "How to use the Apple Product Security PGP Key."

Where possible, CVE IDs are used to reference the vulnerabilities for further information.

To learn about other Security Updates, see "Apple Security Updates."

iTunes 8.1

  • iTunes

    CVE-ID: CVE-2009-0016

    Available for: Windows XP or Vista

    Impact: Sending a maliciously crafted DAAP message may lead to a denial of service

    Description: An infinite loop exists in the handling of iTunes Digital Audio Access Protocol (DAAP) messages. Sending a message containing a maliciously crafted Content-Length parameter in the DAAP header may lead to a denial of service. This update addresses the issue by performing additional validation of DAAP messages. This issue does not affect Mac OS X systems. Credit to Xiaopeng Zhang, Zhenhua Liu, and Junfeng Jia of Fortinet's FortiGuard Global Security Research Team for reporting this issue.

  • iTunes

    CVE-ID: CVE-2009-0143

    Available for: Mac OS X v10.4.10 or later, Mac OS X Server v10.4.10 or later, Windows XP or Vista

    Impact: Subscribing to a malicious podcast may lead to the disclosure of iTunes username and password

    Description: A design issue exists in the iTunes podcast feature. A subscription to a malicious podcast may cause an authentication dialog to be presented to the user. This dialog may entice the user to send iTunes credentials to the podcast server. This update addresses the issue by clarifying the origin of the authentication request in the dialog. Credit to Simon Bellwood for reporting this issue.

Important: Information about products not manufactured by Apple is provided for information purposes only and does not constitute Apple’s recommendation or endorsement. Please contact the vendor for additional information.

Published Date: