CVE-2009-0950

EPSS 28.8%

Stack-based buffer overflow in Apple iTunes before 8.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an itms: URL with a long URL component after a colon.

Affected products

n/a · n/a

public PoCs found — 4

exploitdbwww.exploit-db.com/exploits/16296unverified cve_referencewww.exploit-db.com/exploits/8861unverified cve_referencewww.exploit-db.com/exploits/8934unverified exploitdbwww.exploit-db.com/exploits/11138unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://lists.apple.com/archives/security-announce/2009/Jun/msg00001.html http://osvdb.org/54833 http://redpig.dataspill.org/2009/05/drive-by-attack-for-itunes-811.html http://secunia.com/advisories/35314 https://exchange.xforce.ibmcloud.com/vulnerabilities/50899 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17099 http://static.dataspill.org/releases/itunes/itms_overflow.rb http://support.apple.com/kb/HT3592 https://www.exploit-db.com/exploits/8861 https://www.exploit-db.com/exploits/8934 http://www.securityfocus.com/archive/1/504043/100/0/threaded http://www.securityfocus.com/bid/35157