iTunes vulnerability may enable remote code execution

Researchers have unveiled a flaw in iTunes that could allow cyber criminals to execute remote code on target machines. Gjoko Krstic, a researcher at Zero Science Lab, a Macedonian information security company, announced in a blog post that the heap buffer overflow vulnerability is caused by a boundary error that occurs while playlist files are processed. Attackers who exploit the weakness to bait victims can do so through downloaded malicious data veiled as music. The defect, which affects versions 10.6.1 and 10.6.0 of iTunes, was patched last week in version 10.6.3 of the music player.