The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
iTunes Shared Music Multiple Vulnerabilities (DoS, Spoofing, Flooding)
------------------------------------------------------------------------
SUMMARY
" <http://www.apple.com/itunes/> iTunes is a popular service allowing you
to play music, buy music, download music, share music, create playlists,
etc."
By crafting special UDP packets remote attackers can spoof, flood and DoS
Apple's iTunes product.
DETAILS
Vulnerable Systems:
* iTunes version 6.0 for Windows and prior
* iTunes version 6.0 for Mac OS X and prior
The iTunes Shared Music feature allows users on a network to create
playlists from songs on their computer and to share them on the network.
When user create a new list and enable sharing, other iTunes users will
see the user lists under the Shared Music list, unless they change their
preferences from the default settings. Attackers can create spoofed Shared
Music entries, to rename existing entries, to disconnect existing entries,
and to re-initiate existing lists. Attackers can kill an existing stream
without authorization via an anonymous packet.
Shared Music Entry Spoofing:
It is possible to create fake Shared Music entries by spoofing fake
domain/list names and IP addresses inside an MDNS packet that is used to
broadcast existing lists. This spoofing attack can be scripted to post
numerous entries to specific or all iTunes users on a network (flooding).
By repeated excessive posting of Shared Music Entries, attackers can
create a major system load on systems using iTunes.
Shared Music Entry Rename:
It is possible to rename a valid entry across the network by spoofing the
IP of the originating computer. With this power, attackers can swap
existing Shared Music Entries and trick people into connecting to the
wrong list.
Shared Music Entry Time To Live Spoofing:
It is possible to reset the TTL value of existing lists (or new lists),
thus allowing an attacker to set the TTL on an existing list to one
second, resulting in the list being removed from all client computers,
even if a song is currently being shared.
In order to spoof entries, attackers should first send a SVR packet out
with all the appropriate information, which must then be followed by a
spoofed response packet to convince other iTunes clients that the first
packet was real. In order to create spoofed lists, or to alter existing
lists, attackers must also spoof the originating IP. The IP does not have
to be on the local subnet.
Workaround:
Disable 'Look for shared music' option under the Sharing tab in
Preferences.
ADDITIONAL INFORMATION
The information has been provided by
<mailto:fulldisclosure@fogieonline.com> Seth Fogie .
The original article can be found at:
<http://www.airscanner.com/security/05101001_itunes.htm>
http://www.airscanner.com/security/05101001_itunes.htm
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
