October 25, 2014

Apple releases iTunes 10.7 with support for iOS 6 plus it fixes 163 WebKit vulnerabilities

(LiveHacking.Com) – In the wake of the new iPhone 5 announcement, Apple  has released iTunes 10.7 for Windows  7, Vista and XP to include support for iOS 6 and the new iPhone plus it has taken the opportunity to update the built-in WebKit based web browser. The iTunes Store is web powered and as such uses WebKit to display the current songs, movies and TV which Apple are offering.

WebKit is an open source HTML rendering engine which Apple created. It is also used in Google Chrome. As a result when Apple or Google fix a security issue in WebKit everyone benefits, even iTunes users! This update fixes 163 vulnerabilities.

Apple explains these 163 vulnerabilities in the succinct statement: “Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution.” Which it explains is due to “multiple memory corruption issues existed in WebKit. These issues are addressed through improved memory handling.”

Many of these vulnerabilities have been previously fixed in Google’s Chrome web browser with many of the vulnerabilities being credited to  the “Google Chrome Security Team” or to security researchers who receive rewards from Google for finding bugs like Miaubiz. However Apple did do its fair share of the work with at least 25 of the vulnerabilities being discovered by Apple itself.

iOS 6 will become available on Wednesday, Sept. 19. It will be available for the new iPhone 5 and fifth-generation iPod Touch plus users of the iPhone 4S, iPhone 4, iPhone 3GS, new iPad, iPad 2, and fourth-generation iPod touch will be able to upgrade for free.

You can download iTunes 10.7 from Apple’s official website.

Apple Releases iTunes 10.5.1 to Fix Man-in-the-middle Vulnerability

(LiveHacking.Com) – Apple has released iTunes 10.5.1 to fix a potentially dangerous man-in-the-middle vulnerability. According to the iTunes 10.5.1 security advisory a hacker using a man-in-the-middle attack could offer software to end users that appears to originate from Apple. This is course would be a way to infect a computer with malware. The vulnerability exists in iTunes for Windows and for OS X.

iTunes periodically checks for software updates using an HTTP request to Apple. This request may cause iTunes to indicate that an update is available. If Apple Software Update for Windows is not installed, clicking the Download iTunes button may open the URL from the HTTP response in the user’s default browser. This issue has been mitigated by using a secured connection when checking for available updates. For OS X systems, the user’s default browser is not used because Apple Software Update is included with OS X, however this change adds additional defense-in-depth.

The vulnerability was reported to Apple by Francisco Amato of Infobyte Security Research.

iTunes 10.5.1, which is available for Mac OS X v10.5 or later, Windows 7, Vista and XP SP2 or later also introduces iTunes Match. Announced earlier this year, this new service allows users to store their entire music library in iCloud, including music that has been imported from CDs.

 

Apple Releases iTunes 10.5 With Support for iOS 5 and Fixes for Multiple Vulnerabilities

(LiveHacking.Com) – Apple has released iTunes 10.5 in preparation for the imminent release of iOS5. Along with support for iCloud and wireless syncing, iTunes 10.5 contains a large number of security related fixes for the Windows version. The OS X version contains all the new features but not the security fixes as Apple is planning to release a separate system wide update for OS X to address these vulnerabilities, although some have already been addressed in previous security updates by Apple.

The update fixes 79 vulnerabilities of which 73 are within WebKit, the HTML rendering engine found in Safari and Google Chrome, which Apple also uses to power iTunes. Since fixes are also applied to WebKit via Google’s Vulnerability Rewards Program, names like Sergey Glazunov (famous for his work on Chrome) also appear in the list of contributors.

Other than the WebKit fixes, the following vulnerabilities were patched:

  • A memory corruption issue existed in the handling of string tokenization. This issue does not affect OS X Lion systems. For Mac OS X v10.6 systems, this issue is addressed in Security Update 2011-006.
  • An integer overflow existed in the handling of images with an embedded ColorSync profile, which may lead to a heap buffer overflow. Opening a maliciously crafted image with an embedded ColorSync profile may lead to an unexpected application termination or arbitrary code execution. This issue does not affect OS X Lion systems.
  • A buffer overflow existed in the handling of audio stream encoded with the advanced audio code. This issue does not affect OS X Lion systems.
  • A buffer overflow existed in the handling of H.264 encoded movie files. For OS X Lion systems, this issue is addressed in OS X Lion v10.7.2. For Mac OS X v10.6 systems, this issue is addressed in Security Update 2011-006.
  • A heap buffer overflow existed in ImageIO’s handling of TIFF images. This issue does not affect OS X Lion systems. For Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.8.
  • A reentrancy issue existed in ImageIO’s handling of TIFF images. This issue does not affect Mac OS X systems.

LizaMoon SQL-injection Attack Not as Large as First Thought

Over the last few days, the Internet has been throbbing with news of an SQL-injection attack dubbed LizaMoon which was reported to have infected hundreds of thousands of web pages including iTunes. However these numbers were calculated using Google’s search engine and the number of results available for web pages with the relevant terms in them. Now PCPro has been speaking to a Google engineer and it seems the damage might not be as bad as first thought.

Niels Provos, a principal engineer at Google, has counted the sites with a functioning reference, leaving out those that had the code but didn’t actually redirect users. What he found is that the Lizamoon attack actually peaked in October with 5,600 infected sites, but is currently “undergoing a revival”.

On 29th March 2011 Websense reported that according to a Google Search, over 226,000 URLs have been compromised. This included several iTunes URLs. On the 31st March they reported that a search on Google returns more than 1,500,000 results that have a link with the same URL structure as the initial attack.

However they did mention that “Google Search results aren’t always great indicators of how prevalent or widespread an attack is as it counts each unique URL or page, not domain or site, but it does give some indication of the scope of the problem if you look at how the numbers go up or down over time.”

Using the same search today Google reported 4,670,000 results!

The attack is named LizaMoon after one of the URLs that are injected into web sites. These rogue URLs redirect users to scareware sites which generate messages warning the user that their computer is infected with viruses, and offers to sell them antivirus software.

iTunes 10.2 Includes Important Security Updates on Windows

Apple has released iTunes 10.2 to prepare the way for the arrival of iOS 4.3 and the iPad 2 next week. However 10.2 also contains some important security fixes for the iTunes software on the Windows platform.

According to an advisory issued by US-CERT, the operational arm of the National Cyber Security Division (NCSD) at the Department of Homeland Security (DHS), iTunes 10.2 addresses multiple vulnerabilities which if exploited could allow an attacker to execute arbitrary code or cause a denial-of-service condition.

The vulnerabilities which only affect the Windows platform are in the ImageIO, libxml, and WebKit packages. Apple has released a document which describes the security content of iTunes 10.2.

Along with these fixes and support for iOS 4.3, the iTunes 10.2 update includes improved home sharing, which means you’ll be able to stream music and movies from your computer to iOS 4.3 devices (including iPhone 3GS and above, iPod 3rd generation and above and all models of iPad).