PT-2006-2475 · Apple · Itunes

Publicado 2006-06-29 · Atualizado 2018-10-18 · CVE-2006-1467

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions iTunes versions prior to 6.0.5

Description The issue is related to an integer overflow in the AAC file parsing code, which allows remote user-assisted attackers to execute arbitrary code via a specially crafted AAC file. The file must contain a sample table size (STSZ) atom with a sample size table value that is considered "malformed". This can be exploited when a user opens the malicious AAC file, potentially leading to arbitrary code execution.

Recommendations For versions prior to 6.0.5, update to version 6.0.5 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2006-1467

Produtos afetados

Itunes

Referências · 10

• http://zerodayinitiative.com/advisories/ZDI-06-020.html · Nota
• http://vupen.com/english/advisories/2006/2601 · Aviso do Fabricante
• http://securityfocus.com/archive/1/438812/100/0/threaded · Nota
• http://kb.cert.org/vuls/id/907836 · Correção
• http://secunia.com/advisories/20891 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27481 · Nota
• http://docs.info.apple.com/article.html?artnum=303952 · Correção, Aviso do Fabricante
• http://securitytracker.com/id?1016413 · Nota
• http://securityfocus.com/bid/18730 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-1467 · Nota de Segurança