Apple iTunes < 8.1 Multiple Vulnerabilities (credentialed check)

Medium Nessus Plugin ID 35913


The remote Windows host contains an application that is affected by multiple vulnerabilities.


The version of Apple iTunes installed on the remote Windows host is older than 8.1. Such versions may be affected by multiple vulnerabilities :

- It may be possible to cause a denial of service by sending a maliciously crafted DAAP header to the application. (CVE-2009-0016)

- When subscribing to a podcast an authentication dialog may be presented without clarifying the origin of the authentication request. An attacker could exploit this flaw in order to steal the user's iTunes credentials.


Upgrade to Apple iTunes 8.1 or later.

See Also

Plugin Details

Severity: Medium

ID: 35913

File Name: itunes_8_1.nasl

Version: $Revision: 1.11 $

Type: local

Agent: windows

Family: Windows

Published: 2009/03/13

Modified: 2016/11/23

Dependencies: 25996

Risk Information

Risk Factor: Medium


Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:apple:itunes

Required KB Items: SMB/iTunes/Version

Exploit Available: false

Exploit Ease: No known exploits are available

Reference Information

CVE: CVE-2009-0016, CVE-2009-0143

BID: 34094

OSVDB: 52578, 52579

CWE: 20, 200