iTunes < 4.7.1

medium Nessus Plugin ID 16151

Synopsis

The remote host is missing a Mac OS X update that fixes a security issue.

Description

The remote host is running a version of iTunes which is older than version 4.7.1. The remote version of this software is vulnerable to a buffer overflow when it parses a malformed playlist file (.m3u or .pls files). A remote attacker could exploit this by tricking a user into opening a maliciously crafted file, resulting in arbitrary code execution.

Solution

Upgrade to iTunes 4.7.1 or later.

Plugin Details

Severity: Medium

ID: 16151

File Name: macosx_iTunes_Overflow.nasl

Version: 1.27

Type: local

Agent: macosx

Family: MacOS X Local Security Checks

Published: 1/13/2005

Updated: 11/27/2023

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.0

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.6

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2005-0043

Vulnerability Information

CPE: cpe:/a:apple:itunes

Required KB Items: Host/MacOSX/packages

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 1/11/2005

Vulnerability Publication Date: 1/12/2005

Exploitable With

Metasploit (Apple ITunes 4.7 Playlist Buffer Overflow)

Reference Information

CVE: CVE-2005-0043

BID: 12238

APPLE-SA: APPLE-SA-2005-01-11

Secunia: 13804

Detections

Analytics