CVE-2009-0143: Infoleak
Published Mar 14, 2009
·Updated
Apple iTunes before 8.1 does not properly inform the user about the origin of an authentication request, which makes it easier for remote podcast servers to trick a user into providing a username and password when subscribing to a crafted podcast.
Affected Software
1 affected component
Apple iTunes<8.1
Remediation
Patch Available
Event History
Mar 14, 2009
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Data Sourced
via NVD·06:30 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What must an attacker do to exploit this issue?
An attacker needs to operate or control a remote podcast server and present a crafted podcast that triggers an authentication request. Exploitation also depends on convincing the user to enter a username and password.
2
Which installations are affected?
Apple iTunes versions before 8.1 are affected. The issue can be reached remotely through podcast subscription activity.
3
What is the recommended remediation?
Apply the available patch by updating iTunes to version 8.1 or later.