CVE-2009-0143: Infoleak

Q: What must an attacker do to exploit this issue?

An attacker needs to operate or control a remote podcast server and present a crafted podcast that triggers an authentication request. Exploitation also depends on convincing the user to enter a username and password.

Q: Which installations are affected?

Apple iTunes versions before 8.1 are affected. The issue can be reached remotely through podcast subscription activity.

Q: What is the recommended remediation?

Apply the available patch by updating iTunes to version 8.1 or later.

Published Mar 14, 2009

Updated

Apple iTunes before 8.1 does not properly inform the user about the origin of an authentication request, which makes it easier for remote podcast servers to trick a user into providing a username and password when subscribing to a crafted podcast.

Affected Software

1 affected component

Apple iTunes<8.1

Remediation

Patch Available

http://lists.apple.com/archives/security-announce//2009/Mar/msg00001.html

Patch Available

http://support.apple.com/kb/HT3487

Event History

Mar 14, 2009

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Data Sourced

via NVD·06:30 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What must an attacker do to exploit this issue?

An attacker needs to operate or control a remote podcast server and present a crafted podcast that triggers an authentication request. Exploitation also depends on convincing the user to enter a username and password.

Which installations are affected?

Apple iTunes versions before 8.1 are affected. The issue can be reached remotely through podcast subscription activity.

What is the recommended remediation?

Apply the available patch by updating iTunes to version 8.1 or later.

CVE-2009-0143: Infoleak

Affected Software

Remediation

Patch Available

Patch Available

Event History

Frequently Asked Questions

What must an attacker do to exploit this issue?

Which installations are affected?

What is the recommended remediation?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to exploit this issue?

Which installations are affected?

What is the recommended remediation?