PT-2006-2475 · Apple · Itunes

Published 2006-06-29 · Updated 2018-10-18 · CVE-2006-1467

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions iTunes versions prior to 6.0.5

Description The issue is related to an integer overflow in the AAC file parsing code, which allows remote user-assisted attackers to execute arbitrary code via a specially crafted AAC file. The file must contain a sample table size (STSZ) atom with a sample size table value that is considered "malformed". This can be exploited when a user opens the malicious AAC file, potentially leading to arbitrary code execution.

Recommendations For versions prior to 6.0.5, update to version 6.0.5 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2006-1467

Affected Products

Itunes

References · 10

• http://vupen.com/english/advisories/2006/2601 · Vendor Advisory
• http://kb.cert.org/vuls/id/907836 · Patch
• http://secunia.com/advisories/20891 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-1467 · Security Note
• http://zerodayinitiative.com/advisories/ZDI-06-020.html · Note
• http://securityfocus.com/archive/1/438812/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27481 · Note
• http://docs.info.apple.com/article.html?artnum=303952 · Patch, Vendor Advisory
• http://securitytracker.com/id?1016413 · Note
• http://securityfocus.com/bid/18730 · Note