iTunes Advanced Audio Coding File Handling Integer Overflow Vulnerability

Apple iTunes Advanced Audio Coding File Handling Integer Overflow Vulnerability


About the security content of iTunes 6.0.5


CVE-ID: CVE-2006-1467


Available for: Mac OS X v10.2.8 or later, Windows XP / 2000


Impact: An integer overflow in iTunes could cause a denial of service or lead to the execution of arbitrary code


Description: The AAC file parsing code in iTunes versions prior to 6.0.5 contains an integer overflow vulnerability. Parsing a maliciously-crafted AAC file could cause iTunes to terminate or potentially execute arbitrary code. iTunes 6.0.5 addresses this issue by improving the validation checks used when loading AAC files. iTunes 6.0.5 is freely available from http://www.apple.com/itunes/download/.


http://docs.info.apple.com/article.html?artnum=303952

Leave a Reply