Apple’s Flaw is Exposing iTunes Users on Microsoft Platform
When used with Microsoft Windows, Apple iTunes contained a flaw that could have allowed threat actors to take control of the operating system of a target device. The erstwhile IT behemoth recently corrected it, but only after leaving consumers exposed for at least six months.
On May 23, almost six months to the day after confirming the vulnerability on November 24th, Apple released the patch. It was first alerted to the bug two months earlier by cybersecurity expert Synopsys Research Centre.
The vulnerability, identified by Synopsys as CVE-2023-32353, is defined as “a local privilege escalation vulnerability” that “creates a privileged folder with weak access control.”
It is possible for a regular user to redirect this folder creation to the Windows system directory. This can then be leveraged to obtain a higher-privileged system shell.
Synopsys said
The iTunes vulnerability involves the creation of a directory in the C: Drive, which could potentially grant complete control over the music app’s folder to anyone who accesses it from that particular device.
After the installation, the first user to run the iTunes application can delete the SC Info folder [used to authorize the app on a given device], create a link to the Windows system folder, and recreate the folder.
Synopsys said
Synopsys, which assigned a risk rating of 7.8 out of ten, states that by following this procedure, an attacker could potentially acquire Windows system-level access. If an Apple device running a version prior to 12.12.9 on Microsoft Windows had not received the patch by the specified date, it may have been susceptible to this vulnerability, as mentioned by Synopsys.
Our Readers ALSO READ
Unlocking Smartphones with a New Bruteprint Attack
Found this article helpful, follow our LinkedIn, Facebook, and Twitter for more exclusive content like this.
