Music fans were this week urged to update their iTunes software following the discovery of a serious security bug that creates a means for hackers to take over vulnerable systems.
A bug in code used by iTunes 4.X to parse MPEG-4 files means that maliciously-crafted media files can crash vulnerable versions of the application. In the process, hostile code can be injected into vulnerable systems. A classic buffer overflow attack. iTunes users are advised to update to version 4.8, which features improved validation checks, to guard against possible exploitation.
Danish security reporting firm Secunia rates the iTunes bug as “highly critical”. Exploitations of both Mac OS and Windows machines running iTunes is possible – providing an attacker tricks a user into opening a malicious MPEG-4 file with a vulnerable version of iTunes.
Related
- Firefox 1.5.0.5 update plugs ‘critical’ holes
- uTorrent “Highly Critical” Vulnerability Discovered
- Kazaa security hole undermines network
- ‘Highly critical’ Linux flaw patches
- Apple disables iTunes hack
