Slashdot Mirror
Apple iTunes Security Flaw Discovered?
brajesh writes "CNET News.com is reporting that a critical vulnerability has been found in some versions of Apple's popular iTunes that could allow attackers to remotely take over a user's computer, according to a warning issued by eEye Digital Security, a security research firm. The latest iTunes flaw affects all operating systems from Windows XP to Mac OS X, according to the advisory. The discovery of this latest flaw comes days after Apple issued its iTunes 6 for Windows security update."
Nothing yet, since details of the flaw won't be released by eEye until a patch is released by Apple.
If someone is wondering "should I be worried", the answer is no; exploits of this nature are usually still theoretical and not being exploited en masse "in the wild". Many of these exploits are explicitly discovered by the security organizations who have released the advisories themselves and are often not necessarily representative of any actual exploit being applied maliciously: the idea is to catch security vulnerabilities before they are actually used maliciously. Further, the exploit in question probably requires the user to specifically visit a malicious web site (other than a port open via Rende..., er I mean, Bonjour, when iTunes Sharing is enabled, I don't know of any other avenue to exploit iTunes). The exploit must, therefore, pass a url and/or file to iTunes, and therefore would very likely require visiting a malicious web site.
We don't know the details of the exploit, I can still say with it's extremely likely that it is not something that would be able to spontaneously occur simply by using iTunes in a normal fashion.
This story would more accurately be:
"Some unknown and unannounced flaw found in a piece of software; fix coming from software vendor"
Is this news?
(And it's amusing that if you buy a commercial product from the vendor issuing the vulnerability, you'll be protected! Not a rip on eEye, who has discovered a good deal of vulnerabilities, but it's not as if many of these security entities themselves don't have an interest in finding "vulnerabilities", no matter how nebulous or unlikely.)
A security flaw in an Apple product? That's inconceivable!
I just tried to get quicktime today, and now it comes with mandatory itunes.
(insert wah-wah-wah-waaaaaah sound)
What is it with companies shooting themselves in the foot this week?
iTunes is interesting. It's network streaming music feature has been cracked over and over again, as any college student knows. I'm not surprised that someone figured out how to do more malicious things.
Information wants a fueled airplane waiting at the hangar and no one gets hurt.
Wow. Software has flaw allowing remote hackery. This seems to be pretty typical of just about any piece of software written these days (or any days.)
I guess the question is, do we measure a company and its software by its base security, or by how quickly it responds to a discovered threat? I'm personally inclined to lean towards the second.
Excuse my speling.
Making The Bar Project
Now I know I'll be sticking with WinAmp instead of switching to iTunes. Thanks for the heads-up, slashdot!
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
What TFA doesn't point out is that this will only affect OS X users if you're logged in as root.
You can get it without iTunes from here: http://www.apple.com/quicktime/download/standalone .html
Apple Hackers: 1
Linux Hackers: 2
Windows Hackers: 134,443,229
You guys still got a ways to go... =-)
"Murderer? Well, that's a harsh word. I prefer to think of myself as a Mortality Technician."
Officer! I had to break his kneecaps! When he heard me calling you, he attacked me!
My question would be "how?". How do you write client software that has a remote execute bug in it?
Simple people, recv() call should have a sizeof() call [ok it's not a call... you know what I mean] somewhere in it.
I've released software with bugs in it, but never buffer overflows and what not like this.
Lame lame lame.
Tom
Someday, I'll have a real sig.
Just having iTunes doesn't mean you're automagically vulnerable to whatever this still-unannounced exploit is. And I can say that with surety without even knowing what this "exploit" actually is. And further, iTunes isn't "mandatory" (even though this is repeated ad nauseum):
QuickTime 7 standalone installer, linked right from the download page as "QuickTime Standalone Installer"
Yeeeeeeaaah, I don't trust Apple. I'll just send my credit card details to Russia. Errrr, yeeeah. That's the ticket.
Some of us dont like supporting the russian mafia. And remember, just because a forian government says artist dont have rights, does not mean you should agree. At least apple gives somthing back to the people who write and perform the music.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
Wow. Software has flaw allowing remote hackery. This seems to be pretty typical of just about any piece of software written these days (or any days.)
;)
Except for the thousands of software applications that don't have network functionality!
C17H21NO4
Is http://www.allofmp3.com/ a member of OSTG? I see it so often on slashdot I can't keep from wondering...
Well, that's not a lot of info.
All they say is: 'it's vulnerable! run for the hills!'.
I don't use iTunes, so I don't really care, but what's the vector? Is it a malformed MP3/AAC file? Does iTunes run as a service that listens to a certain port, and can it be attacked through there (probably not likely, as I don't see why a music player should be listening to some port)?
This lacks information, and you really can't do anything to protect yourself if you don't know how the hell the exploit works...
Operating Systems Affected:
All Microsoft Operatins Systems no where does this advisory say that OSX is affected, or any other operating system for that matter. This is Windows-Only, as usual.
We don't know the details of the exploit, I can still say with it's extremely likely that it is not something that would be able to spontaneously occur simply by using iTunes in a normal fashion.
I can still say it's extremely likely that there is no exploit or flaw at all. Why would anyone believe it? There's no evidence of any kind that any exploit or flaw exists, at all.
This story would more accurately be: "Some unknown and unannounced flaw found in a piece of software; fix coming from software vendor"
Close, but more accurate still would be: "Some security company trying to drum up business for itself says its product will protect users from a flaw they claim exists, but offer no details or evidence for."
I highly, highly doubt this is a "remote execute" bug. You can't even talk to iTunes remotely when it's running (unless you have iTunes Sharing running, which is a port available on your local subnet).
Therefore, this vulnerability must represent visiting a malicious web site, which then passes a url and/or file to iTunes. It is NOT a direct, remote execution vulnerability with iTunes itself.
Eeye has some listed as these listed "remote code execution" .. but I have noticed with the case of Windows XP flaws, this usually means the user has to go to a specific webpage or click on at email link. While this is by no means good, it's still better than a flaw that makes your machine open to being taken over via the network without having to trick you into clicking a link.
.. with this iTunes flaw .. is it something that makes your machine vulnerable to remote attack/takeover?
I don't think there has been a "wormable" flaw in Windows since SP2 enabled the FW by default.
Wish Eeye would be clearer when explaining the issue.
So, my question is
Its only available OSX and Windows XP
Yeah, and everyone knows there are _never_ security flaws in web browsers.
First. Please tell me, how is using allofmp3 different--morally or legally in the United States--from downloading the audio files from a P2P network?
Second, what divinatory powers are you using to find that the security hole somehow relates to the iTunes Music Store? I'm not saying that it isn't, but that information is nowhere to be found in the security bulletin and iTunes has more network features than just the ability to hook up to the iTMS.
Integrate Keynote and LaTeX
Oh yeah we usually use those to elevate our privileges once we're in. ;)
i will have to agree with you on that.. the speed in which they fix it is most important.
// This does nothing.
i mean when you are writeing code for any complex software, you go through in your head - this goes here and gets passed into this and it will come in like this - and then someone shoves crap into it and all you can say is WTF why in gods name would you do that, that is when you have to fix it.. because that other person isn't always nice, and you don't get that expericence much before you release the software.
the only way i know how to write a perfectly secure peice of software is:
{
}
'...if only "Jumping to a Conclusion" was an event in the Olympics.'
I don't know the details of the situation, but there are plenty of things an exploit can do even without root: delete or read your files, open up a spam relay, perhaps even log your keystrokes. Is there something special about the nature of this flaw that it can't be exploited at all without root access?
In fairness, eEye has discovered legitimate vulnerabilities that Apple has actually included in OS and security updates.
However, I do agree with you.
And further, it's impossible for this to a "remote execute" vulnerability like the stories based on the extremely vague advisory make it out to be: you can't even talk to iTunes remotely when it's running (unless you have iTunes Sharing enabled, which is available on your local subnet). Therefore, as I've said in another post, this vulnerability *must* be exploited via visiting a malicious web site, which then passes a url and/or file to iTunes. Period. That's the only way this could happen. It's not just something where if you run iTunes, all of a sudden you're vulnerable. Bravo to the way they've positioned it though. They probably floated out some media releases, too. I especially like the last line of the advisory:
Protection: Blink Endpoint Vulnerability Prevention mitigates any potential exploitation of this vulnerability, without requiring a patch or invasive firewall actions.
And, for what it's worth, eEye will release the "details", whatever they are, after Apple has patched whatever the issue is.
But they did not catch the Sony rootkit DRM, did they? Or perhaps they did, but kept quiet?
(And it's amusing that if you buy a commercial product from the vendor issuing the vulnerability, you'll be protected!
Sure, so most likely it's a small flaw overblown over all proportions in order to get some revenue. FUD.
iTunes has a lot more attack surface than than just file sharing via Bonjour. There's the potential for privelege escalation or remote exploit via the iPod service that comes with it. I agree that playing the disclosure game does encourage security companies to release hazy vulnerabilities reports early and often. But dismissing a security threats is generally not a good idea either.
It's annoying the way that Quicktime installs iTunes software on your machine, and buries it in registry so that it starts every time windows does. If you are looking to just have quicktime I would advise you to try an alternative or download the standalone from here.
The rock, the vulture, and the chain
Apple Hackers: 1
Linux Hackers: 2
Windows Hackers: Buffer Overflow
I love how defensive the Apple crowd gets when there's one flaw in their beloved software.
Really though.. thats a major hole. Thats on par with Gmail's last one...
Here is an alternative , I just forgot a quote so the link didn't appear above.
The rock, the vulture, and the chain
First. Please tell me, how is using allofmp3 different--morally or legally in the United States--from downloading the audio files from a P2P network?
It's easier, the files are higher-quality, and, at least in Russia, MediaServices has the rights to distribute the music that they are selling. Whether or not it is leagal for you to download those tracks has not been determined.
Second, what divinatory powers are you using to find that the security hole somehow relates to the iTunes Music Store? I'm not saying that it isn't, but that information is nowhere to be found in the security bulletin and iTunes has more network features than just the ability to hook up to the iTMS.
Unclear. But I despise iTunes for my own reasons - primarily because I cannot buy from the iTMS because Apple somehow believes that my IP is outside of the US, but also because the tracks are DRM-encumbered AAC files.
Not to mention the fact that iTunes is a memory hog, doesn't look or behave like a Windows application, etc.
Both, of course. The first shows how good they are at actually designing and creating software, and the second shows how much they listen to their users/their lawyers/the press. (Take your pick.)
'Sensible' is a curse word.
Where are the spelling nazis when you need them?
He who knows best knows how little he knows. - Thomas Jefferson
from eeye:
"Operating Systems Affected:
All Microsoft Operatins Systems"
Its basically like saying we are water resistant, while Win users are those cheap burger king watches that break by just being out on a humid day
"Slashdot, where telling the truth is overrated but lying is insightful."
find / | grep -vi "Sigur Rós" | xargs rm -f
[% slash_sig_val.text %]
Well, not impossible. Go to System Preferences -> Sharing -> Remote Apple Events. Turn it on. Now someone can do pretty much what they want with your system. If they have a valid username/password (or you turned on the Mac OS 9 password
I could, for example, do something like: That would be mean and cruel. And it works over the Internet. And it would also require me to have a username and password on your machine.
And, for what it's worth, eEye will release the "details", whatever they are, after Apple has patched whatever the issue is.
And if they do, I will care at that time. It's the height of irresponsibility to release details in this way. The only point is to scare people into buying their product. And therefore I consider it, until actual details emerge, a malicious hoax.
This may allow a malicious user on the local system to create an environment where an alternate program will be executed by iTunes.
Emphasis mine.
It would seem that remote attacks not possible unless the attacker had direct access to the machine in question first.
-- it's ridiculous how many people misspell ridiculous... (damn, damn, damn...)
Uh....RTFA. It says that the OS X version is unaffected by this. Only the Windows version is vulnerable.
Enemy of the Sun
This new critical vulnerability was discovered when it was found that someone turned their computer to 'ON' thereby leaving it vulnerable to crackers, hackers, script kiddies and bots. The fact that a human was operating the PC deemed it especially 'critical.'
He who knows best knows how little he knows. - Thomas Jefferson
Since I installed iTunes v6 the program has a fatal error every time I start it. Itune v5 worked fine till i upgraded. I tried uninstalling v6 and putting v5 back on but I still get the same error. It doesn'tidentify the error but just asks me to send the crash info to MS.
Has anyone else had this problem?
The article says it effects Mac OS X as well as windows, and says the security warning says that too, but:
"Operating Systems Affected:
All Microsoft Operatins Systems"
No mention of anything other than Microsoft OS'es in the provided link to the advisory.
"Love is like pi - natural, irrational, and very important." (Lisa Hoffman)
I agree with everything you said. But the general population of Mac users(obviously ones that aren't on /. for one) think they are invunerable to viruses, worms, etc... that was my point, but thanks for the insightful look on the subject.
NO~, I read Slashdot because I think it's stupid.....
First. Please tell me, how is using allofmp3 different--morally or legally in the United States--from downloading the audio files from a P2P network?
Well, with P2P, you aren't supporting the Mob. I'm not a fan of the mob. therefore I would be cautious about using allofmp3. To my knowledge, P2P doesn't support any bad organizations (unless you count music pirates:) )
Forgive me if I am wrong, but I would have to imagine that a "security exploit" of this manner is very much so like breaking into an empty room, that is, with regards to OS X. I mean, yeah, you're in, but what are you going to do in an empty room besides practice your favorite masturbation euphemism? What could be done on OS X via this exploit? Anything?
I just RTFA, and according to it, ..
Operating Systems Affected:
All Microsoft Operatins [sic] Systems
Unless Microsoft wrote OSX, umm..
Ohhh!! NOOO!!!
Someone just exchanged all of my music for the complete ABBA!!!
AAAUUUUGGGGHHHH!!!!
Both? I mean, yes, we should be forgiving of companies who have taken every reasonable step towards security when a flaw is found, so long as they patch it quickly. However, the process of securing your software shouldn't start at SP2. It should be ongoing during the development.
So I think the question is, was iTunes developed with some horrible security design to begin with, for which we should shake our fingers at Apple? Or is this a minor theoretical hack that will be fixed before there's an actual exploit anyway?
> At least apple gives somthing back to the people who write and perform the music.
You do realise Apple give less than four cents in the dollar to any artists on the iTunes Music Store.
Hardly a step up from allofmp3 at all.
By Jove, youre right!
/usr/home/celestina: w allofmp3.com
celestina 11:21am
Organization:
OOO MediaServices
Ivan Fedorov
Planetnaya str. 29
Moscow, 125167
RU
Phone: +7 095 506-5258
Fax..: +7 095 506-5258
Email: admin@allofmp3.com
Registrar Name....: Register.com
Registrar Whois...: whois.register.com
Registrar Homepage: http://www.register.com
Domain Name: ALLOFMP3.COM
Created on..............: Tue, Jun 20, 2000
Expires on..............: Fri, Jun 20, 2008
Record last updated on..: Thu, Feb 12, 2004
Administrative Contact:
OOO MediaServices
Ivan Fedorov
Planetnaya str. 29
Moscow, 125167
RU
Phone: +7 095 506-5258
Fax..: +7 095 506-5258
Email: admin@allofmp3.com
Technical Contact:
OOO MediaServices
Ivan Fedorov
Planetnaya str. 29
Moscow, 125167
RU
Phone: +7 095 506-5258
Fax..: +7 095 506-5258
Email: admin@allofmp3.com
Zone Contact:
OOO MediaServices
Ivan Fedorov
Planetnaya str. 29
Moscow, 125167
RU
Phone: +7 095 506-5258
Fax..: +7 095 506-5258
Email: admin@allofmp3.com
"As the intrepid kobold companion continues his journey, he begins to wonder... if priests raises dead, why anybody die?
Morally in the united states? My morality doesn't change based on what country I'm in. (Maybe that's not what you meant to say...) Basically, I want unencumbered audio, and I think providing encumbered audio is morally repugnant, so I'll buy the tracks from whoever will sell them to me the way I want to buy them. If the record companies want my money, they'll give up on DRM. If not, they won't. If more people felt this way, they would eventually give up on DRM just to get a piece of the action.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
"The latest iTunes flaw affects all operating systems from Windows XP to Mac OS X..."
Funny, it makes it sound like that is a lot of operating systems. It sounds like only two to me.
Worth pointing out that both creating a new user and enabling remote apple events require authentication from an existing admin account, so it would be extremely difficult to perform them remotely with just a current-user remote code exploit.
so with apple having sold over a billion songs.... they've paid out what... 40 million to artists?
hardly chump change when compared to the $0 that the artists got through allofmp3.
Your solution only solves applications with one specific problem. Do you really believe the world of security is that simple?
You keep using that word...I do not think it means what you think it means.
an interesting discussion of allofmp3's legality and mafia connections here: http://www.museekster.com/allofmp3faq.htm
With nothing more to go on than a couple vague sentences from eEye, here's my guess:
One major thing that make iTunes different from other music player apps is the Music Store integration, which operates as a limited web browser. On OSX it calls WebKit; on Windows either Apple built a custom minibrower or it calls Explorer. Does anyone know which, BTW?
In any case, this means that iTunes accepts URLs, specifically itms://[...]. It's also capable (on OSX at least) of launching your default browser and other URL helper apps. I'm guessing that Apple did a bad job validating input, and a malicious itms URL could trick iTunes into launching a remote file as if it were a helper app. Hence the local user context. If this is the case, simply viewing an evil web page (with the itms URL as a redirect/iframe/img/whatever) in most browsers should be sufficient to start the attack.
Hopefully someone will divulge the facts soon. Let's see if I'm even close.
Send Them Back! Or I will destroy them! You know the power I have.... oh? it's free and you get screwed? There is a word for that...
Sig Hansen?
I enjoyed that analogy... :D
Just a thought... what if someone poisoned a podcast? Subscribe to kool sounding podcast, get malicious file via podcast auto-update. Possible attack-vector?
The future is in beta
Of course, then you have to wonder how many of these vulnerabilities are discovered by Black Hats and never release information. Black Hats are probably sitting on hundreds of otherwise undiscovered exploits. There is no reason to believe that only "security organizations" can find exploits like this.
-matthew
"THERE IS NO JUSTICE, THERE IS ONLY ME." -Death
Yes, I believe all security problems are caused by people sending in the wrong size to recv().
That is the only possible way a program can be flawed.
Tom
Someday, I'll have a real sig.
Is this a case of eEye E-I/O?
-b
myselfmusic
It would be interesting to see how much went to artists that were already multi-millionaires and those who really could use it. And of those that could use it, how much did they get?
BUT, the exposure probably got a few TV/commercial deals, and most likely increased concert attendance--all of which actually earn artists money. Of course, AllOfMP3 helps with that too.
Of course, the best bet is to just drop commercial-radio crap altogether and support indi music through GarageBand, other indi sites and Podcasts.
Not that I'm in any way an expert, but I tried to do something like that last weekend (for good reasons, I tell ya, good!) and it didn't work. iTunes seems to really check over the file you're grabbing, so unless there's a vulnerability in the mp3 player itself (embedding bad stuff in media files etc), I'm thinkin' it won't work.
The world's only surviving livewriter.
Why would people believe it? Most likely because the company wouldn't want to be sued for libel by Apple.
I'll never make that mistake again, reading the experts' opinions. - Feynman
Indeed. If this is what they mean -- which I doubt, but then again, I also doubt they have a real flaw here anyway -- it would not be a flaw.
Caution: that code is not necesarilly secure. A hijacked compiler could add a backdoor.
I'll never make that mistake again, reading the experts' opinions. - Feynman
iTunes also runs on Windows 2000.
End of Line.
": This story initially quoted an incorrect report on the eEye Digital Security Web site saying an iTunes security flaw affected both Windows and Mac operating systems. To clarify, eEye is still testing the flaw on the Mac OS."
My parents went to Las Vegas so that i could witness "'Peak Oil'".
Er, I think you'll find that Apple pays the labels, not the artists. We all know how generous RIAA members are, hein?
Now, if you feel strongly about supporting the RIAA-Mafia over the Russian-Mafia, I guess that's your deal. Seems a trivial distinction, IMO.
Yes, indeed. And this is why Apple is abandoning PPC and going with Intel. Intel does not have an eieio instruction.
Troll.
I'm kidding! I've been modded a troll before for non-troll remarks. Just learn to accept that the trolls eventually get mod points and will mod you a troll because they don't agree with you.
"That's so plausible, I can't believe it!" - Leela
All Microsoft systems. This is news?
the advisory only says in windows
get glasses.
FTFA:
:)
"However, eEye is now testing whether the flaw also affects iTunes running on Mac operating systems."
Well, as of now it's only Windows.
The advisory has been corrected.
After eEye mistakenly posted a note on its Web site saying the iTunes flaw affected "all operating systems," the security firm updated its warning to indicate that the flaw had been found only on the Windows operating system so far.
from the corrected advisory:
Operating Systems Affected:
All Microsoft Operatins Systems
No other OSes listed, just MS. So Mac OS X is not known to be affected.
iTunes has a lot more attack surface than than just file sharing via Bonjour.
Referring to "file sharing via Bonjour" makes as much sense as saying "file sharing via DNS". Bonjour/Rendezvous/ZeroConf is not a file sharing technology. It's multicast DNS. It's used to advertise the availability of a service - any service - to other hosts. Apple includes an Apache module, for instance, that uses Bonjour to advertise the presence of an HTTP server, and Safari uses Bonjour to look for them. But Bonjour's role in the process ends there; when Safari connects to a web server, it's using bog-standard HTTP, regardless of whether it found that server via Bonjour, DNS, or is using the "raw" IP address.
How many times does this bit of misinformation need to be corrected, anyway?
Lost: Sig, white with black letters. No collar. Reward if found!
Waffles, they smell good and tast great.
> so with apple having sold over a billion songs....
> they've paid out what... 40 million to artists?
> hardly chump change when compared to the $0
> that the artists got through allofmp3.
The post you replied to was lying through their teeth. Apple doesn't pay artists, Apple pays their suppliers, and they pay them 70c per song.
Every supplier. ALL of them get 70c per song. Some labels keep 9c out of that, others keep nearly all of it. If anyone wants to look at who's ripping off artists, it ain't iTunes. Artists still get to choose which label they're gouged/paid by, and the ones who go with the labels that rip them off have only themselves to blame.
The way I understand this (from the one line in the CNet report), if you install malicious.exe on Windows or malicious.app on MacOS X, and then you go and rename malicious.exe to iTunes.exe or malicious.app to iTunes.app and then set up things in a certain way, it is possible that some code trying to launch iTunes would launch the malicious app, now called iTunes.
Be afraid. Be very afraid. The world is coming to an end.
good point.. mabey i should add a line that checks it's crc but that would require thought
'...if only "Jumping to a Conclusion" was an event in the Olympics.'
Windows XP (Home, Pro, etc.), Windows 2000, Windows 2003, blah blah blah
Slashdot: Failed Car Analogies. Amateur Lawyering. Anecdote Battles.
Independant artists selling on iTunes via CDbaby get about 65 cents of the 99 cent sale.
That's pretty good.
Artists under the RIAA umbrella get about 5-10c I think.
And Server 2003. And presumably the betas of Vista, but that doesn't really count.
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
i have to write somthing here to get posted, but the answer to the parent question is in the subject line. nothing more to see her. move along.
"Win treats sysadmins better than users. Mac treats users better than sysadmins. Linux treats everyone like sysadmins."
Is that any worse than supporting the American mafia, aka RIAA?
And remember, just because a forian government says artist dont have rights, does not mean you should agree.
And just because a domestic government says that a cabal of megacorporations does have certain rights does not mean you should agree.
At least apple gives somthing back to the people who write and perform the music.
Really? I thought they paid the music distributors, who then make a game of playing "steal from the artist". Do you have any evidence to the contrary?
Ironically, I'm about as conservative as you can get, but the music companies have so thoroughly demonstrated their complete lack of regard to any part of me but my wallet that I just don't care about them anymore. I personally do not download or upload music (I've got a family and can't afford the legal exposure), but that's purely out of pragmatism and not because I think it's morally wrong in any way.
On the other hand, I've bought quite a few CDs from artists at CDBaby, and I'd never infringe their stuff. Respect is a mutual relationship.
Dewey, what part of this looks like authorities should be involved?
ZOMG SONY^H^H^H^HAPPLE ROOTKIT ...Oh, wait, it's not Sony, we can't say rootkit. Nevermind.
Goten Xiao
...and sometimes, why bother?
Nothing to see here, move along. Sounds like this CRITICAL vulnerability isn't much of a vulnerability and isn't very critical...
My apologies for running with that piece of misinformation. The original parent post led me to believe Bonjour was a file sharing service, not general purpose network discovery protocol. I admit I'm not familiar with the specifics of Rendezvous or Bonjour, and I appreciate the correction. But I don't think that changes my point about the dangers of dismissing vulnerabilities without understanding the real attack surface.
Mac OS X will start to show more and more vulnerabilities as it ages. This is mostly what's wrong with Windows today, there is so much legacy code. Also, there is a lot of fear to change things significantly because of the possibility of breaking third party code (so many programs tie in to Internet Explorer for example, I'm sure this is why it's taken so long to rewrite it). I think as OS X ages, you will find lots of people still running 10.0 or 10.1 (did those even have a personal firewall?) with horribly vulnerable machines. Just like in the Windows world, they are not going to want to pay to upgrade their machine to the latest version of OS X, probably because they've been fed crap about how secure OS X is and "who needs to upgrade when it works fine for me?". Right now life is good for Apple, but lets see about 8 years from now when they have to deal with all the legacy crap code out there.....
So you believe something without evidence just because if they are not telling the truth, they might get in trouble?
Oooooooooo K.
According to the dictionary:
via: through, by way of; by means of, with the aid of, by virtue of.
According to you:
Bonjour: multicast DNS, used to advertise the availability of a service
So, to repeat his statement using your words, and the definition:
"iTunes has a lot more attack surface than than just file sharing with the aid of multicast DNS "
Where is the so called misinformation?
-= Who are The Headlocks? =-
eEye do sell products, some of which are pretty good. What importantly they have an excellent record with vulnerability research. Ryan Russell works for them f'heavens sake. (clue: who gave the Code Red worm it's name, and why?) Sorry Pudge, you're way out of line on this one. (Could it be you're speculating about an area you don't know much about? On Slashdot? Who woulda thunk it?! :)
Oh, and Apple already released a patched version, a week or so ago. Monitoring Full Disclosure, Bugtraq and so on is part of my job :)
"None are more hopelessly enslaved than those who falsely believe they are free." -- Goethe
If you're talking about iDwefence
Why would I be doing that?
eEye do sell products, some of which are pretty good.
I couldn't care less. Without details, the security announcement is worse than useless. It's only point is to make money for the people making the announcement.
Sorry Pudge, you're way out of line on this one.
Not remotely, no. This is about proper security procedure. Absolultely no details were provided. The only purpose of the annoucement was to sell a product for the people making the announcement. This is Wrong.
Oh, and Apple already released a patched version, a week or so ago.
Then why the lack of details? And why did the announcement imply there was currently no fix except for their own product? According to you, eEye lied in their announcement, and you're defending them??
Pull the other one!
There is a widely held and mistaken impression that you can no longer download Quicktime for Windows without iTunes. This is incorrect. They just don't promote the standalone version of Quicktime as adamantly as the combo package. The link has always been there on the same page and probably always will be. If you go to the Quicktime download page and look down and to the right there is a set of text links, one of which says "Quicktime Standalone Installer". There you can download Quicktime for Windows sans iTunes.
e .html/
linky: http://www.apple.com/quicktime/download/standalon
Reading Comprehension(TM).
My question:
"Please tell me, how is using allofmp3 different--*morally or legally* in the United States--from downloading the audio files from a P2P network?"
Your answer:
"It's easier, the files are higher-quality, and, at least in Russia, MediaServices has the rights to distribute the music that they are selling."
It being easier and higher-quality has absolutely nothing to do with morality and legality, and what is legal in Russia with respect to this service has pretty much nothing to do with what is legal in the United States.
Integrate Keynote and LaTeX