Last night while I was watching the decidedly one sided football game I noticed an update was now available for iTunes. I naturally assumed that this was in fact due to the roll out of the new iPod Touch. Well, turns out there was a little more to it than I thought.
The joy of assumptions.
From Apple:
CVE-ID: CVE-2007-3752
Available for: Mac OS X v10.3.9, Mac OS X v10.4.7 or later, Windows XP / Vista
Impact: Opening a maliciously crafted music file may lead to an unexpected application termination or arbitrary code execution
Description: A buffer overflow exists in iTunes when processing album cover art. By enticing a user to open a maliciously crafted music file, an attacker may trigger the overflow which may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing proper bounds checking. Credit to David Thiel of iSEC Partners for reporting this issue.
Tags: iTunes 7.4, iTunes Buffer Overflow, Apple iTunes Vulnerability
