November 15, 2011, 7:52AM
Apple Fixes Man-in-the-Middle Bug in iTunes
3 CommentsApple has issued a fix for a flaw in iTunes that could enable an attacker to perform man-in-the-middle attacks against users. The vulnerability is fixed in iTunes 10.5.1.
The bug in iTunes relates to the way that the application communicates with the iTunes server when it's checking for updates to the software. The problem was such that an attacker who had a man-in-the-middle position on a user's network could potentially give the user a fraudulent or malicious app that looks like iTunes.
"Description: iTunes periodically checks for software updates using an HTTP request to Apple. This request may cause iTunes to indicate that an update is available. If Apple Software Update for Windows is not installed, clicking the Download iTunes button may open the URL from the HTTP response in the user's default browser. This issue has been mitigated by using a secured connection when checking for available updates. For OS X systems, the user's default browser is not used because Apple Software Update is included with OS X, however this change adds additional defense-in-depth," the Apple advisory says.
Whereas Microsoft has its monthly Patch Tuesday release, Apple is spreading its patches out over what's becoming a patch week. The company on Nov. 10 released a patch for Java on Mac OS X and then on Thursday it pushed out fixes for iOS, Time Capsule and AirPort Base Station.
Users can download the new version of iTunes by checking for updates within the application's Help menu.
Recommended Reads
Commenting on this Article is closed.
Today's Most Popular
- Dear Jailbreaker, Apple Wants to Have a Word with You
- Defense Contractor Northrop Grumman Hiring For Offensive Cyber Ops
- OPINION: Are Anonymous Members Forged in the Crucible of IT Compliance?
- Forget 'Brogrammers,' Women Have The Edge In DEFCON Social Engineering Contest
- White House Security Czar Howard Schmidt Retiring
Most Commented Stories
Newsletter Sign-up
Take Our Poll
The Internet Crime Complaint Center recently warned of malware targeting travelers connecting to Wi-Fi. When traveling, do you
Connect to anything
22%
Only connect to password-protected, secure connections
38%
Only use websites with HTTPS
27%
I don’t pay attention to how I access the internet while traveling
13%
Total votes: 60
Follow Threatpost
 |  |  |  |
| Tumblr |
Comments
iTunes may be exploited by M in M attacks when checking for updates so we should check for updates? Is this a real story?
This is almost as good as an email saying to submit your banking information so we can be sure your banking information has not been stolen!!!