iTunes, QuickTime security

Apple has reported a new security vulnerability affecting iTunes and QuickTime, which could lead to code being run on the system, according PC Pro. "The integer overflow and heap-based buffer overflow vulnerability affects both the Mac OS X and Windows versions of QuickTime Player 7.0.3 and 7.0.4 and iTunesj 6.0.1 and 6.0.2. An attacker who successfully exploited the flaw would be able to run code in the context of the logged in user. Most Windows users have admin accounts for day to day use with much greater privileges than Mac users, whose user accounts have limited rights and permissions." The report says that Security company eEye Digital describes the flaw as "high" in terms of severity and that Apple has yet to issue any patches for the affected software. Both are listed on the security research firm's website: EEYEB-20060307a and EEYEB-20060307b. [updated: direct links to flaws added]

by MacNN Staff