the just released iTunes 12.1.1 for Windows still comes with
outdated and VULNERABLE 3rd party libraries and vulnerable
command lines:
In AppleMobileDeviceSupport.msi:
* libeay32.dll and ssleay32.dll 0.9.8za from 2014-06-05
The current version is 0.9.8ze and has 21 security fixes
which are missing in 0.9.8za; see <http://openssl.org/news/>
At last, these DLLs are no more 7 years old as before, but
"only" 8 months old.
* libcurl.dll 7.16.2
is EIGHT years old and has at least 22 unfixed CVEs!
The current version is 7.40.0; for the fixed vulnerabilities
see <http://curl.haxx.se/docs/
An attacker can load these vulnerable DLLs and call their buggy
routines to exploit these bugs!
In AppleApplicationSupport.msi:
* msvcr100.dll and msvcp100.dll 10.0.40219.1 from 2011-02-20
These are the runtime DLLs for Visual C++ 2010 RTM.
The current version is but 10.0.40219.325; see
https://technet.microsoft.com/
An attacker can load these vulnerable DLLs and and call their
buggy routines to exploit their bugs!
Additionally the following VULNERABLE[*] command lines with unquoted
pathnames containing spaces are registered.
By AppleApplicationSupport.msi:
[HKEY_CLASSES_ROOT\CLSID\{
@="[#AppleApplicationSupport_
[HKEY_CLASSES_ROOT\CLSID\{
@="[#AppleApplicationSupport_
[HKEY_CLASSES_ROOT\CLSID\{
@="[#AppleApplicationSupport_
For beginners: the value of the unnamed registry entry is a COMMAND
LINE and has to be quoted properly!
From <https://msdn.microsoft.com/
| To help provide system security, use quoted strings in the path to
| indicate where the executable filename ends and the arguments begin.
As of Windows 2003 developers who are NOT completely unaware of
Microsofts documentation might want to use the "ServerExecutable"
registry entry described there too.
But 12 years are surely way too short for Apple's developers, QA and
management to learn about such "new" features which help improve safety
and security.
By iTunes.msi:
[HKEY_CLASSES_ROOT\itms\shell\
@="[#iTunes.exe] /url \"%1\""
[HKEY_CLASSES_ROOT\iTunes\
@="[#iTunes.exe] /url \"%1\""
[HKEY_CLASSES_ROOT\daap\shell\
@="[#iTunes.exe] /url \"%1\""
[HKEY_CLASSES_ROOT\itmss\
@="[#iTunes.exe] /url \"%1\""
[HKEY_CLASSES_ROOT\itsradio\
@="[#iTunes.exe] /url \"%1\""
[HKEY_CLASSES_ROOT\
@="[#iTunes.exe] /url \"%1\""
[HKEY_LOCAL_MACHINE\SOFTWARE\
@="[#iTunes.exe]"
[HKEY_CLASSES_ROOT\itpc\shell\
@="[#iTunes.exe] /url \"%1\""
[HKEY_CLASSES_ROOT\itls\shell\
@="[#iTunes.exe] /url \"%1\""
[HKEY_CLASSES_ROOT\iTunes.
@="[INSTALLDIR]iTunes.exe /url \"%1\""
[HKEY_CLASSES_ROOT\pcast\
@="[INSTALLDIR]iTunes.exe /url \"%1\""
[HKEY_CLASSES_ROOT\iTunes.
@="[INSTALLDIR]iTunes.exe /url \"%1\""
[HKEY_CLASSES_ROOT\iTunes.
@="[INSTALLDIR]iTunes.exe /url \"%1\""
[HKEY_CLASSES_ROOT\iTunes.
@="[INSTALLDIR]iTunes.exe /url \"%1\""
[HKEY_CLASSES_ROOT\iTunes.
@="[INSTALLDIR]iTunes.exe /url \"%1\""
[HKEY_CLASSES_ROOT\iTunes.
@="[INSTALLDIR]iTunes.exe /url \"%1\""
From <http://msdn.microsoft.com/
| If any element of the command string contains or might contain
| spaces, it must be enclosed in quotation marks. Otherwise, if
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| the element contains a space, it will not parse correctly.
JFTR: the command lines referenced above are about 1/3 of all
the command lines registered by iTunes.msi; the other 2/3
have properly quoted pathnames.
See <http://home.arcor.de/
detect software with this 20+ year old vulnerability[*] without
dissecting its *.MSI files.
Until Apple's developers, their QA and their managers start to
develop a sense for their customers safety and security and
due diligence: stay away from Apple's (Windows) software!
stay tuned
Stefan Kanthak
[*] <https://cwe.mitre.org/data/
You'll read more about it soon!
Komentarų nėra:
Rašyti komentarą