full-disclosure - [FD] iTunes 11.2.2 for Windows: completely outdated and vulnerable 3rd party libraries

Open Source and information security mailing list archives

Message-ID: <DD332B1A729D4E348A89935F1EC0EAD7@celsius>
Date: Mon, 7 Jul 2014 11:04:23 +0200
From: "Stefan Kanthak" <stefan.kanthak@...go.de>
To: <bugtraq@...urityfocus.com>
Cc: fulldisclosure@...lists.org
Subject: [FD] iTunes 11.2.2 for Windows: completely outdated and vulnerable
	3rd party libraries

Hi @ll,

Apples current iTunes 11.2.2 for Windows comes with the following
COMPLETELY outdated and vulnerable 3rd party libraries (as part of
AppleApplicationSupport.msi):

* libeay32.dll and ssleay32.dll 0.9.8d

  are more than SEVEN years old and have at least 27 unfixed CVEs!
  the current version is 0.9.8za, see <http://www.openssl.org/news/>

* libcurl.dll 7.16.2

  is more than SEVEN years old and has at least 18 unfixed CVEs!
  the current version is 7.37.0;
  see <http://curl.haxx.se/docs/security.html>
  for the fixed vulnerabilities!

* libxml2.dll 2.6.0.0

  is more than TEN years old and has at least 17 unfixed CVEs!
  the current version is 2.9.1, for the latest vulnerability see
  CVE-2013-0339

* icuuc40.dll, icuin40.dll, icudt49.dll, libicuuc.dll and libicuin.dll 49.1.1

  have at least 4 unfixed CVEs: CVE-2013-2419, CVE-2013-2383, CVE-2013-2384,
  CVE-2013-1569

Until Apples developers start to develop a sense for safety and security:
stay away from their (Windows) software!

regards
Stefan Kanthak

Timeline:
~~~~~~~~~

2014-06-06    informed vendor

2014-06-06    vendor sent automated response

... no more reaction

2014-07-03    requested status

... no answer

2014-07-07    report published

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives