Apple iTunes before 8.1 does not properly inform the user about the origin of an authentication request, which makes it easier for remote podcast servers to trick a user into providing a username and password when subscribing to a crafted podcast.

The remote version of iTunes is affected by a remote information disclosure vulnerability.  By tricking a user on the affected host into authenticating to a malicious podcast, an attacker could gain the user's iTunes account information.

The version of Apple iTunes on the remote host is prior to version 8.1. It is, therefore, affected by multiple vulnerabilities :

  - A remote attacker can cause a denial of service by     sending a maliciously crafted DAAP message. Note that     this vulnerability only affects iTunes running on a     Windows host. (CVE-2009-0016)

  - When subscribing to a podcast, an authentication dialog     may be presented to the user without clarifying the     origin of the authentication request. An attacker could     exploit this flaw in order to steal the user's iTunes     credentials. (CVE-2009-0143)

The version of Apple iTunes installed on the remote Windows host is older than 8.1. Such versions may be affected by multiple vulnerabilities :
  - It may be possible to cause a denial of service by     sending a maliciously crafted DAAP header to the     application. (CVE-2009-0016)

  - When subscribing to a podcast an authentication dialog     may be presented without clarifying the origin of the     authentication request. An attacker could exploit this     flaw in order to steal the user's iTunes credentials.
    (CVE-2009-0143)

According to its banner, the version of iTunes installed on the remote host is older than 8.1.

Such versions may be affected by multiple vulnerabilities : 

  - It may be possible to cause a denial of service by sending a maliciously crafted DAAP header to the application. Note that this flaw only affects iTunes running on a Windows host. (CVE-2009-0016)

  - When subscribing to a podcast an authentication dialog may be presented without clarifying the origin of the authentication request. An attacker could exploit this flaw in order to steal the user's iTunes credentials. (CVE-2009-0143)"); 

ID	Name	Product	Family	Severity
35915	iTunes < 8.1 Malicious Podcast Information Disclosure (Mac OS X)	Nessus	MacOS X Local Security Checks	medium
35914	Apple iTunes < 8.1 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	medium
35913	Apple iTunes < 8.1 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	medium
4958	iTunes < 8.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium

Detections

Analytics

CVE-2009-0143

high

Tenable Plugins

medium

medium

medium

medium