CVE-2006-1467 – Apple iTunes AAC File Parsing Integer Overflow Vulnerability

https://notcve.org/view.php?id=CVE-2006-1467

Integer overflow in the AAC file parsing code in Apple iTunes before 6.0.5 on Mac OS X 10.2.8 or later, and Windows XP and 2000, allows remote user-assisted attackers to execute arbitrary code via an AAC (M4P, M4A, or M4B) file with a sample table size (STSZ) atom with a "malformed" sample_size_table value. This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Apple iTunes. Exploitation requires an attacker to convince a target user into opening a malicious play list file. The specific flaw exists during the processing of malicious AAC media files such as those with extensions .M4A and .M4P. During the parsing of the sample table size atom (STSZ), a malformed 'sample_size_table' value can trigger an integer overflow leading to an exploitable memory corruption. • http://docs.info.apple.com/article.html?artnum=303952 http://secunia.com/advisories/20891 http://securitytracker.com/id?1016413 http://www.kb.cert.org/vuls/id/907836 http://www.securityfocus.com/archive/1/438812/100/0/threaded http://www.securityfocus.com/bid/18730 http://www.vupen.com/english/advisories/2006/2601 http://www.zerodayinitiative.com/advisories/ZDI-06-020.html https://exchange.xforce.ibmcloud.com/vulnerabilities/27481 • CWE-189: Numeric Errors •