Apple's iTunes 8.1 plugs malicious podcast security hole

Apple on Thursday released iTunes 8.1, which includes a fix for a vulnerability that could lead to theft of usernames and passwords if a podcast containing malware were subscribed to.

The software update addresses a design issue in the iTunes podcast feature that made it possible for a subscription to a malicious podcast to cause an authentication dialog to be displayed that could prompt the user for log-in credentials to the podcast server, Apple's advisory said.

The issue affects Mac OS X v 10.4.10 and later. The issue was reported by Simon Bellwood.

iTunes 8.1 also fixes a vulnerability that could allow maliciously crafted Digital Audio Access Protocol messages to cause a denial of service on computers running Windows XP or Vista. Fortinet's Fortiguard Global Security Research team is credited with discovering this bug.

[kernmapp]

they still hav not fixed the cd burning issue!

[BtmnHatesRbn]

And what "issue" is that? I make CDs and data discs all the time with iTunes...any version since 2.0.4.

[annie33026]

Is that what's wrong with my cd burner????????

[BtmnHatesRbn]

The only two podcasts I ever encountered that wanted log-in info was Rush Limbaugh's and Jerry Doyle's.

[Perry_Clease]

Does Rush want iTunes to fail :)

[Lockdog91]

I installed 8.1 and it's not letting me manually update my media on my iPhone. When I click on the Manual Update option, it's stating that my data's stored on another computer and I will lose my data if I proceed. I hope they get it fixed.