ALARM Group ALERT - click for a description of ALARM, The Computing Alert System Alert Number:  090707-01 Alert Date:  09/07/07 Alert Title:  iTunes 7.4 addresses security vulnerability Update-to:   none OS/Platform/Application:  Mac OS X v10.4.7 and Later Mac OS X v10.3.9 Microsoft Windows XP and Vista Category:  ALERT Severity: low Attention:  System Administrators, Desktop Support Personnel, Mac and Windows iTunes users

Summary:  On September 5 2007 Apple released version 7.4 of its popular iTunes application for both Mac and Windows platforms.  Version 7.4 addresses a vulnerability in iTunes that could allow for arbitrary code execution upon processing (opening) specifically-drafted album art.

Recommended Actions:  Persons who manage or maintain Mac/Windows systems that use iTunes are encouraged to apply the upgrade immediately as per the instructions provided by the vendor. 

ITS Actions:  At this time, ITS is taking no specific additional actions to address this software update release.

Resources:

iTunes 7.4 Security Content overview:
http://docs.info.apple.com/article.html?artnum=306404

Secunia Advisory (provides good explanation of the exploit):
http://secunia.com/advisories/26725/