PT-2024-31026 · Apple · Itunes

Bocheng Xiang + 1 · Published 2024-10-02 · Updated 2024-12-26 · CVE-2024-44193

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions iTunes versions prior to 12.13.3

Description A logic issue was addressed with improved restrictions, which could allow a local attacker to elevate their privileges. The issue is related to a local privilege escalation vulnerability.

Recommendations For versions prior to 12.13.3, update to iTunes 12.13.3 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive features or modules in iTunes until the update is applied.

Exploit

Fix

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

CVE-2024-44193

Affected Products

Itunes

References · 32

• 🔥 https://github.com/mbog14/CVE-2024-44193 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-44193 · Security Note
• https://osv.dev/vulnerability/CVE-2024-44193 · Vendor Advisory
• https://support.apple.com/en-us/121328 · Vendor Advisory
• https://t.me/p0x3k/1959 · Telegram Post
• https://twitter.com/SecPod/status/1846142913341788393 · Twitter Post
• https://twitter.com/CyfirmaR/status/1844368921337659616 · Twitter Post
• https://twitter.com/CCBalert/status/1843999574249123943 · Twitter Post
• https://twitter.com/DoteSergio/status/1845902586626371991 · Twitter Post
• https://t.me/ckure/14790 · Telegram Post
• https://t.me/secharvester/17309 · Telegram Post
• https://twitter.com/LeVPN/status/1853016617761824821 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1843106930166050824 · Twitter Post
• https://twitter.com/42mayfly/status/1848254046831878275 · Twitter Post
• https://t.me/offensivetwitter/2703 · Telegram Post