[HIB]iTunes Exploit Can Be Used to Attack Windows

In version 9.1, Apple fixed a "Remote Binary Planting" vulnerability reported by Acros, a security research lab in Slovenia. The vulnerability is interesting in an of itself, but not news in that way. What is news is the revelation yesterday on Twitter by HD Moore of Metasploit fame that "...this issue affects about 40 different apps, including the Windows shell." The vulnerability describes a way to trick iTunes into loading a DLL from a remote share over WebDAV by tricking the user into loading media from that share. As Acros says, it's not hard to envision social engineering to accomplish this. As quoted on Threatpost, Moore says "The bug is bad behavior on the part of certain Windows applications when loading files from a network share." He declined to name the 40 apps (other than the Windows shell), but added that "It's a wide range of things that are vulnerable, some open-source as well as commercial."

**Hidden Content: To see this hidden content your post count must be 1 or greater.**