Buffer overflow in Apple iTunes before 9.0.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted .pls file.

According to its banner, the version of iTunes installed on the remote host is older than 9.0.1.  Such versions are potentially affected by a remote buffer overflow when opening specially crafted '.pls' files.  An attacker could exploit this flaw to execute arbitrary code on the remote host subject to the privileges of the user running the application. 

The version of Apple iTunes on the remote host is prior to version 9.0.1. It is, therefore, affected by a buffer overflow vulnerability involving the handling of PLS files. By convincing a user to open a specially crafted PSL file, a remote attacker can cause a denial of service or execute arbitrary code with the user's level of privileges.

The remote version of Apple iTunes is older than 9.0.1. Such versions are affected by a buffer overflow involving the handling of PLS files.
If an attacker can trick a user on the affected host into opening a malicious PLS file, he can leverage this issue to crash the affected application or to execute arbitrary code on the affected system subject to the user's privileges.

The remote version of iTunes is older than 9.0.1. Such versions are affected by a buffer overflow involving the handling of PLS files.  If an attacker can trick a user on the affected host into opening a malicious PLS file, he can leverage this issue to crash the affected application or to execute arbitrary code on the affected system subject to the user's privileges.

ID	Name	Product	Family	Severity
5182	iTunes < 9.0.1 Remote Code Execution	Nessus Network Monitor	Web Clients	medium
41061	Apple iTunes < 9.0.1 PLS File Buffer Overflow (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	high
41060	Apple iTunes < 9.0.1 PLS File Buffer Overflow (credentialed check)	Nessus	Windows	high
41059	iTunes < 9.0.1 PLS File Buffer Overflow (Mac OS X)	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2009-2817

high

Tenable Plugins

medium

high

high

high