(Apple Issues Fix for iTunes) Blackberry Device Software Bug in WebKit Lets Remote Users Execute Code
SecurityTracker Alert ID: 1025384|
SecurityTracker URL: http://securitytracker.com/id/1025384
(Links to External Site)
Date: Apr 18 2011
Execution of arbitrary code via network, User access via network|
Fix Available: Yes Vendor Confirmed: Yes |
Version(s): prior to 10.2.2|
A vulnerability was reported in Blackberry Device Software. A remote user can cause arbitrary code to be executed on the target user's system. Apple iTunes is affected.|
A remote user can create specially crafted HTML that, when loaded by the target user, will execute arbitrary code on the target system.
The code can access user data stored on the media card and in the built-in media storage on the BlackBerry smartphone, but not email and other personal information stored on the file system of the BlackBerry smartphone.
The following devices are affected:
* BlackBerry Bold 9650 smartphone
* BlackBerry Bold 9700 smartphone
* BlackBerry Bold 9780 smartphone
* BlackBerry Curve 9300 Series
* BlackBerry Pearl 9100 Series
* BlackBerry Style 9670 smartphone
* BlackBerry Torch 9800 smartphone
This vulnerability was demonstrated at the Pwn2Own 2011 Contest.
Vincenzo Iozzo, Ralf Philipp Weinmann, and Willem Pinckaers reported this vulnerability via TippingPoint's Zero Day Initiative.
A remote user can create HTML that, when loaded by the target user, will execute arbitrary code on the target user's system.|
Apple has issued a fix for iTunes (10.2.2), which is affected by this vulnerability.|
The Apple advisory will be available at:
|Underlying OS: Windows (7), Windows (Vista), Windows (XP)|
This archive entry is a follow-up to the message listed below.|
Source Message Contents
Subject: APPLE-SA-2011-04-18-1 iTunes 10.2.2|
-----BEGIN PGP SIGNED MESSAGE-----
APPLE-SA-2011-04-18-1 iTunes 10.2.2
iTunes 10.2.2 is now available and addresses the following:
Available for: Windows 7, Vista, XP SP2 or later
Impact: A man-in-the-middle attack may lead to an unexpected
application termination or arbitrary code execution
Description: Multiple memory corruption issues exist in WebKit. A
man-in-the-middle attack while browsing the iTunes Store via iTunes
may lead to an unexpected application termination or arbitrary code
CVE-2011-1290 : Vincenzo Iozzo, Willem Pinckaers, Ralf-Philipp
Weinmann, and an anonymous researcher working with TippingPoint's
Zero Day Initiative
CVE-2011-1344 : Vupen Security working with TippingPoint's Zero Day
Initiative, and Martin Barbella
iTunes 10.2.2 may be obtained from:
For Mac OS X:
The download file is named: "iTunes10.2.2.dmg"
Its SHA-1 digest is: 7b94065174927dbce71182c89a00b3966021ceb8
For Windows XP / Vista / Windows 7:
The download file is named: "iTunesSetup.exe"
Its SHA-1 digest is: 30c97f21cb7ec9921b80c7dfd3a9f460b6746045
For 64-bit Windows XP / Vista / Windows 7:
The download file is named: "iTunes64Setup.exe"
Its SHA-1 digest is: 10d04b03e9733827e69a20bcf46f5e7ea97e0cd3
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (Darwin)
-----END PGP SIGNATURE-----
Do not post admin requests to the list. They will be ignored.
Security-announce mailing list (Securityemail@example.com)