Apple iTunes Security Flaw Discovered?

brajesh writes "CNET News.com is reporting that a critical vulnerability has been found in some versions of Apple's popular iTunes that could allow attackers to remotely take over a user's computer, according to a warning issued by eEye Digital Security, a security research firm. The latest iTunes flaw affects all operating systems from Windows XP to Mac OS X, according to the advisory. The discovery of this latest flaw comes days after Apple issued its iTunes 6 for Windows security update."

Comments

Only as root

[Anonymous Coward]

What TFA doesn't point out is that this will only affect OS X users if you're logged in as root.

quicktime standalone

[ubergrits]

You can get it without iTunes from here: http://www.apple.com/quicktime/download/standalone .html

Vulnerable Operating Systems

[xWastedMindx]

Operating Systems Affected:
All Microsoft Operatins Systems no where does this advisory say that OSX is affected, or any other operating system for that matter. This is Windows-Only, as usual.

from TFA

[circusboy]

This may allow a malicious user on the local system to create an environment where an alternate program will be executed by iTunes.

Emphasis mine.

It would seem that remote attacks not possible unless the attacker had direct access to the machine in question first.