Detections
Analytics

iTunes for Windows < 11.2 Multiple Vulnerabilities

high Nessus Network Monitor Plugin ID 9397

Synopsis

The remote host is running a version of iTunes that is vulnerable to multiple vulnerabilities.

Description

Versions of iTunes earlier than 11.2 are affected by multiple vulnerabilities :

 - A flaw exists in the way Set-Cookie HTTP headers are processed when the connection is closed before the header line was complete. An attacker could strip security settings from the cookie by forcing the connection to close before the security settings were sent, and then obtain the value of the unprotected cookie. (CVE-2014-1296)
 - A memory corruption issue exists in iTunes MP4 parsing. A maliciously crafted audio or movie file could be used to trigger an unexpected application termination or arbitrary code execution. (CVE-2014-8842)

Solution

Upgrade to Apple iTunes 11.2 or later.

See Also

https://support.apple.com/en-us/HT202976

Plugin Details

Severity: High

ID: 9397

Family: Web Clients

Published: 7/19/2015

Updated: 3/6/2019

Nessus ID: 74040, 74041

Risk Information

VPR

Risk Factor: Low

Score: 2.7

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 6.9

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:apple:itunes

Patch Publication Date: 9/23/2015

Vulnerability Publication Date: 9/23/2015

Reference Information

CVE: CVE-2014-1296, CVE-2014-8842

BID: 67024