KLA10877 Multiple vulnerabilities in iTunes

Multiple serious vulnerabilities have been found in Apple iTunes. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code, bypass security restrictions or obtain sensitive information.

Below is a complete list of vulnerabilities

1. Multiple unknown vulnerabilities can be exploited remotely via a specially designed content to cause denial of service or execute arbitrary code;
2. Improper certificates verification can be exploited remotely via a specially designed certificate to obtain sensitive information;
3. An unknown vulnerability can be exploited remotely via HTTP sessions manipulations to bypass security restrictions;
4. Lack of restrictions can be exploited remotely via a specially designed content to obtain sensitive information.

Technical details

Vulnerability (2) related to improper verification of X.509 certificate.

Vulnerability (3) can be exploited by conducting DNS rebinding attack via leveraging HTTP/0.9 support.

Vulnerability (4) related to lack of restriction on location variable.

Original advisories

Apple advisory

Related products

Apple-iTunes

CVE list

CVE-2016-4769 high

CVE-2016-4768 high

CVE-2016-4767 high

CVE-2016-4766 high

CVE-2016-4765 high

CVE-2016-4763 warning

CVE-2016-4762 high

CVE-2016-4760 warning

CVE-2016-4759 high

CVE-2016-4758 warning

Solution

Update to the latest version

Get iTunes

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Apple iTunes versions earlier than 12.5.1 on Windows