|
|
|
|
| |
"iTunes is a popular service allowing you to play music, buy music, download music, share music, create playlists, etc."
By crafting special UDP packets remote attackers can spoof, flood and DoS Apple's iTunes product. |
| |
Credit:
The information has been provided by Seth Fogie .
The original article can be found at: http://www.airscanner.com/security/05101001_itunes.htm
|
| |
Vulnerable Systems:
* iTunes version 6.0 for Windows and prior
* iTunes version 6.0 for Mac OS X and prior
The iTunes Shared Music feature allows users on a network to create playlists from songs on their computer and to share them on the network. When user create a new list and enable sharing, other iTunes users will see the user lists under the Shared Music list, unless they change their preferences from the default settings. Attackers can create spoofed Shared Music entries, to rename existing entries, to disconnect existing entries, and to re-initiate existing lists. Attackers can kill an existing stream without authorization via an anonymous packet.
Shared Music Entry Spoofing:
It is possible to create fake Shared Music entries by spoofing fake domain/list names and IP addresses inside an MDNS packet that is used to broadcast existing lists. This spoofing attack can be scripted to post numerous entries to specific or all iTunes users on a network (flooding). By repeated excessive posting of Shared Music Entries, attackers can create a major system load on systems using iTunes.
Shared Music Entry Rename:
It is possible to rename a valid entry across the network by spoofing the IP of the originating computer. With this power, attackers can swap existing Shared Music Entries and trick people into connecting to the wrong list.
Shared Music Entry Time To Live Spoofing:
It is possible to reset the TTL value of existing lists (or new lists), thus allowing an attacker to set the TTL on an existing list to one second, resulting in the list being removed from all client computers, even if a song is currently being shared.
In order to spoof entries, attackers should first send a SVR packet out with all the appropriate information, which must then be followed by a spoofed response packet to convince other iTunes clients that the first packet was real. In order to create spoofed lists, or to alter existing lists, attackers must also spoof the originating IP. The IP does not have to be on the local subnet.
Workaround:
Disable 'Look for shared music' option under the Sharing tab in Preferences.
|
|
|
|
|
|
|
|
|
|
