Integer overflow in the IopfCompleteRequest API in the kernel in Microsoft Windows 2000, XP, Server 2003, and Vista allows context-dependent attackers to gain privileges. NOTE: this issue was originally reported for GEARAspiWDM.sys 2.0.7.5 in Gear Software CD DVD Filter driver before 4.001.7, as used in other products including Apple iTunes and multiple Symantec and Norton products, which allows local users to gain privileges via repeated IoAttachDevice IOCTL calls to \\.\GEARAspiWDMDevice in this GEARAspiWDM.sys. However, the root cause is the integer overflow in the API call itself.

The remote host is running iTunes, an application for managing and listening to music media files.

This version of iTunes is vulnerable to a several local flaws.  The first involves an integer overflow and would result in the local attacker executing arbitrary code with the privileges of the iTunes program.  The second flaw involves misleading firewall messages that may lead to a false sense of security. 

The version of Apple iTunes on the remote host is prior to version 8.0. It is, therefore, affected by an integer buffer overflow vulnerability in an included third party driver. A local user can exploit this to gain system privileges.

The version of Apple iTunes installed on the remote Windows host is older than 8.0. Such versions include a third-party driver that are affected by an integer buffer overflow that could allow a local user to gain system privileges.

ID	Name	Product	Family	Type	Severity
4653	iTunes < 8.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		high
34158	Apple iTunes < 8.0 Integer Buffer Overflow (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	Remote	high
34157	Apple iTunes < 8.0 Integer Buffer Overflow (credentialed check)	Nessus	Windows	Local	high

Detections

Analytics

CVE-2008-3636

high

Tenable Plugins

high

high

high