About the security content of iTunes 8.0

This document describes the security content of iTunes 8.0, which can be downloaded and installed via Software Update preferences, or from Apple Downloads.

For the protection of our customers, Apple does not disclose, discuss or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To find out more about Apple Product Security, see the Apple Product Security website.

For information about the Apple Product Security PGP Key, see "How to use the Apple Product Security PGP Key."

Where possible, CVE IDs are used to reference the vulnerabilities for further information.

To find out about other Security Updates, see "Apple Security Updates."

iTunes 8.0

• iTunes

  CVE-ID: CVE-2008-3634

  Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11

  Impact: Firewall warning dialogue in iTunes is misleading

  Description: When the firewall is configured to block iTunes Music Sharing and the user enables iTunes Music Sharing in iTunes, a warning dialogue is displayed, which incorrectly informs the user that unblocking iTunes Music Sharing doesn’t affect the firewall’s security. Allowing iTunes Music Sharing or any other service through the firewall inherently affects security by exposing the service to remote entities. This update addresses the issue by refining the text in the warning dialogue. This issue does not affect systems running Mac OS X v10.5 or later. Credit info to Eric Hall of DarkArt Consulting Services, Inc. for reporting this issue.

• iTunes

  CVE-ID: CVE-2008-3636

  Available for: Windows XP or Vista

  Impact: A local user may gain system privileges

  Description: A third-party driver provided with iTunes may trigger an integer overflow, and could allow a local user to obtain system privileges. Credit to Ruben Santamarta of Wintercore for reporting this issue.