Vulnerabilities > CVE-2017-7053 - Unspecified vulnerability in Apple Itunes

047910
CVSS 9.3 - CRITICAL
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
apple
microsoft
critical
nessus

Summary

An issue was discovered in certain Apple products. iTunes before 12.6.2 on Windows is affected. The issue involves the "iTunes" component. It allows attackers to execute arbitrary code in a privileged context via a crafted app.

Vulnerable Configurations

Part Description Count
Application
Apple
213
OS
Microsoft
1

Nessus

  • NASL familyPeer-To-Peer File Sharing
    NASL idITUNES_12_6_2_BANNER.NASL
    descriptionThe version of Apple iTunes running on the remote host is prior to 12.6.2. It is, therefore, affected by multiple vulnerabilities : - Multiple out-of-bounds read errors exist in the libxml2 component due to improper handling of specially crafted XML documents. An unauthenticated, remote attacker can exploit these to disclose user information. (CVE-2017-7010, CVE-2017-7013) - Multiple memory corruption issues exist in the Webkit Web Inspector component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit these, via a specially crafted web page, to corrupt memory, resulting in the execution of arbitrary code. (CVE-2017-7012) - Multiple memory corruption issues exist in the WebKit component due to improper validation of input. An unauthenticated, remote attacker can exploit these issues, via a specially crafted web page, to execute arbitrary code. (CVE-2017-7018, CVE-2017-7020, CVE-2017-7030, CVE-2017-7034, CVE-2017-7037, CVE-2017-7039, CVE-2017-7040, CVE-2017-7041, CVE-2017-7042, CVE-2017-7043, CVE-2017-7046, CVE-2017-7048, CVE-2017-7049, CVE-2017-7052, CVE-2017-7055, CVE-2017-7056, CVE-2017-7061) - A memory corruption issue exists in the
    last seen2020-06-01
    modified2020-06-02
    plugin id101955
    published2017-07-25
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/101955
    titleApple iTunes < 12.6.2 Multiple Vulnerabilities (uncredentialed check)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(101955);
      script_version("1.5");
      script_cvs_date("Date: 2019/11/12");
    
      script_cve_id(
        "CVE-2017-7010",
        "CVE-2017-7012",
        "CVE-2017-7013",
        "CVE-2017-7018",
        "CVE-2017-7019",
        "CVE-2017-7020",
        "CVE-2017-7030",
        "CVE-2017-7034",
        "CVE-2017-7037",
        "CVE-2017-7039",
        "CVE-2017-7040",
        "CVE-2017-7041",
        "CVE-2017-7042",
        "CVE-2017-7043",
        "CVE-2017-7046",
        "CVE-2017-7048",
        "CVE-2017-7049",
        "CVE-2017-7052",
        "CVE-2017-7053",
        "CVE-2017-7055",
        "CVE-2017-7056",
        "CVE-2017-7061",
        "CVE-2017-7064"
      );
      script_bugtraq_id(
        99879,
        99884,
        99885,
        99889,
        99890
      );
      script_xref(name:"APPLE-SA", value:"APPLE-SA-2017-07-19-6");
    
      script_name(english:"Apple iTunes < 12.6.2 Multiple Vulnerabilities (uncredentialed check)");
      script_summary(english:"Checks the version of iTunes.");
    
      script_set_attribute(attribute:"synopsis", value:
    "An application running on the remote host is affected by multiple
    vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of Apple iTunes running on the remote host is prior to
    12.6.2. It is, therefore, affected by multiple vulnerabilities :
    
      - Multiple out-of-bounds read errors exist in the libxml2
        component due to improper handling of specially crafted
        XML documents. An unauthenticated, remote attacker can
        exploit these to disclose user information.
        (CVE-2017-7010, CVE-2017-7013)
    
      - Multiple memory corruption issues exist in the Webkit
        Web Inspector component due to improper validation of
        user-supplied input. An unauthenticated, remote attacker
        can exploit these, via a specially crafted web page, to
        corrupt memory, resulting in the execution of arbitrary
        code. (CVE-2017-7012)
    
      - Multiple memory corruption issues exist in the WebKit
        component due to improper validation of input. An
        unauthenticated, remote attacker can exploit these
        issues, via a specially crafted web page, to execute
        arbitrary code. (CVE-2017-7018, CVE-2017-7020,
        CVE-2017-7030, CVE-2017-7034, CVE-2017-7037,
        CVE-2017-7039, CVE-2017-7040, CVE-2017-7041,
        CVE-2017-7042, CVE-2017-7043, CVE-2017-7046,
        CVE-2017-7048, CVE-2017-7049, CVE-2017-7052,
        CVE-2017-7055, CVE-2017-7056, CVE-2017-7061)
    
      - A memory corruption issue exists in the 'WebKit Page
        Loading' component due to improper validation of input.
        An unauthenticated, remote attacker can exploit this,
        via a specially crafted web page, to execute arbitrary
        code. (CVE-2017-7019)
    
      - A flaw exists in the iPodService component when handling
        the iPodManager COM control due to insufficient access
        restrictions. A local attacker can exploit this, via
        a specially crafted application, to execute arbitrary
        code with system privileges. (CVE-2017-7053)
    
      - An unspecified memory initialization issue exists in
        Webkit. A local attacker can exploit this, via a
        specially crafted application, to disclose the contents
        of restricted memory. (CVE-2017-7064)
    
    Note that Nessus has not tested for these issues but has instead
    relied only on the application's self-reported version number.");
      script_set_attribute(attribute:"see_also", value:"https://support.apple.com/en-us/HT207928");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Apple iTunes version 12.6.2 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-7053");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/06/26");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/07/19");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/07/25");
    
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:apple:itunes");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Peer-To-Peer File Sharing");
    
      script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("itunes_sharing.nasl");
      script_require_keys("iTunes/sharing");
      script_require_ports("Services/www", 3689);
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("http.inc");
    
    port = get_http_port(default:3689, embedded:TRUE, ignore_broken:TRUE);
    
    get_kb_item_or_exit("iTunes/" + port + "/enabled");
    
    type = get_kb_item_or_exit("iTunes/" + port + "/type");
    source = get_kb_item_or_exit("iTunes/" + port + "/source");
    version = get_kb_item_or_exit("iTunes/" + port + "/version");
    
    fixed_version = "12.6.2";
    
    if (ver_compare(ver:version, fix:fixed_version, strict:FALSE) < 0)
    {
      report = '\n  Version source    : ' + source +
               '\n  Installed version : ' + version +
               '\n  Fixed version     : ' + fixed_version +
               '\n';
      security_report_v4(port:port, extra:report, severity:SECURITY_HOLE);
    }
    else audit(AUDIT_LISTEN_NOT_VULN, "iTunes", port, version);
    
  • NASL familyMacOS X Local Security Checks
    NASL idMACOS_ITUNES_12_6_2.NASL
    descriptionThe version of Apple iTunes installed on the remote macOS or Mac OS X host is prior to 12.6.2. It is, therefore, affected by multiple vulnerabilities : - Multiple out-of-bounds read errors exist in the libxml2 component due to improper handling of specially crafted XML documents. An unauthenticated, remote attacker can exploit these to disclose user information. (CVE-2017-7010, CVE-2017-7013) - Multiple memory corruption issues exist in the Webkit Web Inspector component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit these, via a specially crafted web page, to corrupt memory, resulting in the execution of arbitrary code. (CVE-2017-7012) - Multiple memory corruption issues exist in the WebKit component due to improper validation of input. An unauthenticated, remote attacker can exploit these issues, via a specially crafted web page, to execute arbitrary code. (CVE-2017-7018, CVE-2017-7020, CVE-2017-7030, CVE-2017-7034, CVE-2017-7037, CVE-2017-7039, CVE-2017-7040, CVE-2017-7041, CVE-2017-7042, CVE-2017-7043, CVE-2017-7046, CVE-2017-7048, CVE-2017-7049, CVE-2017-7052, CVE-2017-7055, CVE-2017-7056, CVE-2017-7061) - A memory corruption issue exists in the
    last seen2020-06-01
    modified2020-06-02
    plugin id101956
    published2017-07-25
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/101956
    titleApple iTunes < 12.6.2 Multiple Vulnerabilities (macOS) (credentialed check)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(101956);
      script_version("1.5");
      script_cvs_date("Date: 2019/11/12");
    
      script_cve_id(
        "CVE-2017-7010",
        "CVE-2017-7012",
        "CVE-2017-7013",
        "CVE-2017-7018",
        "CVE-2017-7019",
        "CVE-2017-7020",
        "CVE-2017-7030",
        "CVE-2017-7034",
        "CVE-2017-7037",
        "CVE-2017-7039",
        "CVE-2017-7040",
        "CVE-2017-7041",
        "CVE-2017-7042",
        "CVE-2017-7043",
        "CVE-2017-7046",
        "CVE-2017-7048",
        "CVE-2017-7049",
        "CVE-2017-7052",
        "CVE-2017-7053",
        "CVE-2017-7055",
        "CVE-2017-7056",
        "CVE-2017-7061",
        "CVE-2017-7064"
      );
      script_bugtraq_id(
        99879,
        99884,
        99885,
        99889,
        99890
      );
      script_xref(name:"APPLE-SA", value:"APPLE-SA-2017-07-19-6");
    
      script_name(english:"Apple iTunes < 12.6.2 Multiple Vulnerabilities (macOS) (credentialed check)");
      script_summary(english:"Checks the version of iTunes.");
    
      script_set_attribute(attribute:"synopsis", value:
    "An application installed on the remote host is affected by multiple
    vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of Apple iTunes installed on the remote macOS or Mac OS X
    host is prior to 12.6.2. It is, therefore, affected by multiple
    vulnerabilities :
    
      - Multiple out-of-bounds read errors exist in the libxml2
        component due to improper handling of specially crafted
        XML documents. An unauthenticated, remote attacker can
        exploit these to disclose user information.
        (CVE-2017-7010, CVE-2017-7013)
    
      - Multiple memory corruption issues exist in the Webkit
        Web Inspector component due to improper validation of
        user-supplied input. An unauthenticated, remote attacker
        can exploit these, via a specially crafted web page, to
        corrupt memory, resulting in the execution of arbitrary
        code. (CVE-2017-7012)
    
      - Multiple memory corruption issues exist in the WebKit
        component due to improper validation of input. An
        unauthenticated, remote attacker can exploit these
        issues, via a specially crafted web page, to execute
        arbitrary code. (CVE-2017-7018, CVE-2017-7020,
        CVE-2017-7030, CVE-2017-7034, CVE-2017-7037,
        CVE-2017-7039, CVE-2017-7040, CVE-2017-7041,
        CVE-2017-7042, CVE-2017-7043, CVE-2017-7046,
        CVE-2017-7048, CVE-2017-7049, CVE-2017-7052,
        CVE-2017-7055, CVE-2017-7056, CVE-2017-7061)
    
      - A memory corruption issue exists in the 'WebKit Page
        Loading' component due to improper validation of input.
        An unauthenticated, remote attacker can exploit this,
        via a specially crafted web page, to execute arbitrary
        code. (CVE-2017-7019)
    
      - A flaw exists in the iPodService component when handling
        the iPodManager COM control due to insufficient access
        restrictions. A local attacker can exploit this to
        execute arbitrary code with system privileges.
        (CVE-2017-7053)
    
      - An unspecified memory initialization issue exists in
        Webkit. A local attacker can exploit this, via a
        specially crafted application, to disclose the contents
        of restricted memory. (CVE-2017-7064)
    
    Note that Nessus has not tested for these issues but has instead
    relied only on the application's self-reported version number.");
      script_set_attribute(attribute:"see_also", value:"https://support.apple.com/en-us/HT207928");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Apple iTunes version 12.6.2 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-7053");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/06/26");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/07/19");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/07/25");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:apple:itunes");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("macosx_itunes_detect.nasl");
      script_require_keys("Host/MacOSX/Version", "installed_sw/iTunes");
    
      exit(0);
    }
    
    include("vcf.inc");
    
    os = get_kb_item("Host/MacOSX/Version");
    if (!os) audit(AUDIT_OS_NOT, "Mac OS X");
    
    app_info = vcf::get_app_info(app:"iTunes");
    
    constraints = [{"fixed_version" : "12.6.2"}];
    
    vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);
    
  • NASL familyWindows
    NASL idITUNES_12_6_2.NASL
    descriptionThe version of Apple iTunes installed on the remote Windows host is prior to 12.6.2. It is, therefore, affected by multiple vulnerabilities : - Multiple out-of-bounds read errors exist in the libxml2 component due to improper handling of specially crafted XML documents. An unauthenticated, remote attacker can exploit these to disclose user information. (CVE-2017-7010, CVE-2017-7013) - Multiple memory corruption issues exist in the Webkit Web Inspector component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit these, via a specially crafted web page, to corrupt memory, resulting in the execution of arbitrary code. (CVE-2017-7012) - Multiple memory corruption issues exist in the WebKit component due to improper validation of input. An unauthenticated, remote attacker can exploit these issues, via a specially crafted web page, to execute arbitrary code. (CVE-2017-7018, CVE-2017-7020, CVE-2017-7030, CVE-2017-7034, CVE-2017-7037, CVE-2017-7039, CVE-2017-7040, CVE-2017-7041, CVE-2017-7042, CVE-2017-7043, CVE-2017-7046, CVE-2017-7048, CVE-2017-7049, CVE-2017-7052, CVE-2017-7055, CVE-2017-7056, CVE-2017-7061) - A memory corruption issue exists in the
    last seen2020-06-01
    modified2020-06-02
    plugin id101954
    published2017-07-25
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/101954
    titleApple iTunes < 12.6.2 Multiple Vulnerabilities (credentialed check)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(101954);
      script_version("1.5");
      script_cvs_date("Date: 2019/11/12");
    
      script_cve_id(
        "CVE-2017-7010",
        "CVE-2017-7012",
        "CVE-2017-7013",
        "CVE-2017-7018",
        "CVE-2017-7019",
        "CVE-2017-7020",
        "CVE-2017-7030",
        "CVE-2017-7034",
        "CVE-2017-7037",
        "CVE-2017-7039",
        "CVE-2017-7040",
        "CVE-2017-7041",
        "CVE-2017-7042",
        "CVE-2017-7043",
        "CVE-2017-7046",
        "CVE-2017-7048",
        "CVE-2017-7049",
        "CVE-2017-7052",
        "CVE-2017-7053",
        "CVE-2017-7055",
        "CVE-2017-7056",
        "CVE-2017-7061",
        "CVE-2017-7064"
      );
      script_bugtraq_id(
        99879,
        99884,
        99885,
        99889,
        99890
      );
      script_xref(name:"APPLE-SA", value:"APPLE-SA-2017-07-19-6");
    
      script_name(english:"Apple iTunes < 12.6.2 Multiple Vulnerabilities (credentialed check)");
      script_summary(english:"Checks the version of iTunes on Windows.");
    
      script_set_attribute(attribute:"synopsis", value:
    "An application installed on the remote host is affected by multiple
    vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of Apple iTunes installed on the remote Windows host is
    prior to 12.6.2. It is, therefore, affected by multiple
    vulnerabilities :
    
      - Multiple out-of-bounds read errors exist in the libxml2
        component due to improper handling of specially crafted
        XML documents. An unauthenticated, remote attacker can
        exploit these to disclose user information.
        (CVE-2017-7010, CVE-2017-7013)
    
      - Multiple memory corruption issues exist in the Webkit
        Web Inspector component due to improper validation of
        user-supplied input. An unauthenticated, remote attacker
        can exploit these, via a specially crafted web page, to
        corrupt memory, resulting in the execution of arbitrary
        code. (CVE-2017-7012)
    
      - Multiple memory corruption issues exist in the WebKit
        component due to improper validation of input. An
        unauthenticated, remote attacker can exploit these
        issues, via a specially crafted web page, to execute
        arbitrary code. (CVE-2017-7018, CVE-2017-7020,
        CVE-2017-7030, CVE-2017-7034, CVE-2017-7037,
        CVE-2017-7039, CVE-2017-7040, CVE-2017-7041,
        CVE-2017-7042, CVE-2017-7043, CVE-2017-7046,
        CVE-2017-7048, CVE-2017-7049, CVE-2017-7052,
        CVE-2017-7055, CVE-2017-7056, CVE-2017-7061)
    
      - A memory corruption issue exists in the 'WebKit Page
        Loading' component due to improper validation of input.
        An unauthenticated, remote attacker can exploit this,
        via a specially crafted web page, to execute arbitrary
        code. (CVE-2017-7019)
    
      - A flaw exists in the iPodService component when handling
        the iPodManager COM control due to insufficient access
        restrictions. A local attacker can exploit this to
        execute arbitrary code with system privileges.
        (CVE-2017-7053)
    
      - An unspecified memory initialization issue exists in
        Webkit. A local attacker can exploit this, via a
        specially crafted application, to disclose the contents
        of restricted memory. (CVE-2017-7064)
    
    Note that Nessus has not tested for these issues but has instead
    relied only on the application's self-reported version number.");
      script_set_attribute(attribute:"see_also", value:"https://support.apple.com/en-us/HT207928");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Apple iTunes version 12.6.2 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-7053");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/06/26");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/07/19");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/07/25");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:apple:itunes");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("itunes_detect.nasl");
      script_require_keys("installed_sw/iTunes Version", "SMB/Registry/Enumerated");
    
      exit(0);
    }
    
    include("vcf.inc");
    
    # Ensure this is Windows
    get_kb_item_or_exit("SMB/Registry/Enumerated");
    
    app_info = vcf::get_app_info(app:"iTunes Version", win_local:TRUE);
    
    constraints = [{"fixed_version" : "12.6.2"}];
    
    vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);