Deskripsi CVE

Stack-based buffer overflow in Apple iTunes before 8.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an itms: URL with a long URL component after a colon.

Informasi CVE

Kelemahan Terkait

CWE-ID	Nama Kelemahan	Sumber
CWE-119	Improper Restriction of Operations within the Bounds of a Memory Buffer The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.

Metrik

Metrik	Skor	Tingkat keparahan	CVSS Vektor	Sumber
V2	9.3		AV:N/AC:M/Au:N/C:C/I:C/A:C	nvd@nist.gov

EPSS

EPSS adalah model penilaian yang memprediksi kemungkinan suatu kerentanan dieksploitasi.

Skor EPSS

Model EPSS menghasilkan skor probabilitas antara 0 dan 1 (0 hingga 100%). Semakin tinggi skor, semakin besar probabilitas bahwa suatu kerentanan akan dieksploitasi.

Persentil EPSS

Persentil digunakan untuk meranking CVE berdasarkan skor EPSS mereka. Misalnya, CVE di persentil ke-95 berdasarkan skor EPSS-nya lebih mungkin dieksploitasi daripada 95% CVE lainnya. Dengan demikian, persentil digunakan untuk membandingkan skor EPSS suatu CVE dengan CVE lainnya.

EPSS First.org

Informasi eksploitasi

Exploit Database EDB-ID : 16296

Tanggal publikasi : 2010-11-10 23h00 +00:00
Penulis : Metasploit
Terverifikasi EDB : Yes

Exploit Database EDB-ID : 8861

Tanggal publikasi : 2009-06-02 22h00 +00:00
Penulis : Will Drewry
Terverifikasi EDB : Yes

Exploit Database EDB-ID : 8934

Tanggal publikasi : 2009-06-11 22h00 +00:00
Penulis : ryujin
Terverifikasi EDB : Yes

Exploit Database EDB-ID : 11138

Tanggal publikasi : 2010-01-13 23h00 +00:00
Penulis : Simo36
Terverifikasi EDB : Yes

Produk yang Disebutkan

Konfigurasi 0

Apple>>Itunes >> Version Hingga (termasuk) 8.1.1

Apple>>Itunes >> Version 1.0

Apple>>Itunes >> Version 1.1

Apple>>Itunes >> Version 1.1.1

Apple>>Itunes >> Version 1.1.2

Apple>>Itunes >> Version 2.0

Apple>>Itunes >> Version 2.0.1

Apple>>Itunes >> Version 2.0.2

Apple>>Itunes >> Version 2.0.3

Apple>>Itunes >> Version 2.0.4

Apple>>Itunes >> Version 3.0

Apple>>Itunes >> Version 3.0.1

Apple>>Itunes >> Version 4.0

Apple>>Itunes >> Version 4.0.0

Apple>>Itunes >> Version 4.0.1

Apple>>Itunes >> Version 4.1

Apple>>Itunes >> Version 4.1.0

Apple>>Itunes >> Version 4.2

Apple>>Itunes >> Version 4.2.0

Apple>>Itunes >> Version 4.2.72

Apple>>Itunes >> Version 4.5

Apple>>Itunes >> Version 4.5.0

Apple>>Itunes >> Version 4.6

Apple>>Itunes >> Version 4.6.0

Apple>>Itunes >> Version 4.7

Apple>>Itunes >> Version 4.7.0

Apple>>Itunes >> Version 4.7.1

Apple>>Itunes >> Version 4.7.1.30

Apple>>Itunes >> Version 4.7.2

Apple>>Itunes >> Version 4.8

Apple>>Itunes >> Version 4.8.0

Apple>>Itunes >> Version 4.9

Apple>>Itunes >> Version 4.9.0

Apple>>Itunes >> Version 5.0

Apple>>Itunes >> Version 5.0.0

Apple>>Itunes >> Version 5.0.1

Apple>>Itunes >> Version 6.0

Apple>>Itunes >> Version 6.0.0

Apple>>Itunes >> Version 6.0.1

Apple>>Itunes >> Version 6.0.2

Apple>>Itunes >> Version 6.0.3

Apple>>Itunes >> Version 6.0.4

Apple>>Itunes >> Version 6.0.4.2

Apple>>Itunes >> Version 6.0.5

Apple>>Itunes >> Version 7.0.0

Apple>>Itunes >> Version 7.0.1

Apple>>Itunes >> Version 7.0.2

Apple>>Itunes >> Version 7.1.0

Apple>>Itunes >> Version 7.1.1

Apple>>Itunes >> Version 7.2.0

Apple>>Itunes >> Version 7.3.0

Apple>>Itunes >> Version 7.3.1

Apple>>Itunes >> Version 7.3.2

Apple>>Itunes >> Version 7.4

Apple>>Itunes >> Version 7.4.0

Apple>>Itunes >> Version 7.4.1

Apple>>Itunes >> Version 7.4.2

Apple>>Itunes >> Version 7.4.3

Apple>>Itunes >> Version 7.5

Apple>>Itunes >> Version 7.5.0

Apple>>Itunes >> Version 7.6

Apple>>Itunes >> Version 7.6.0

Apple>>Itunes >> Version 7.6.1

Apple>>Itunes >> Version 7.6.2

Apple>>Itunes >> Version 7.7

Apple>>Itunes >> Version 7.7.0

Apple>>Itunes >> Version 7.7.1

Apple>>Itunes >> Version 8.0

Apple>>Itunes >> Version 8.0.0

Apple>>Itunes >> Version 8.0.1

Apple>>Itunes >> Version 8.0.2

Apple>>Itunes >> Version 8.1

Referensi

http://www.vupen.com/english/advisories/2009/1470
Tags : vdb-entry, x_refsource_VUPEN

http://www.securityfocus.com/bid/35157
Tags : vdb-entry, x_refsource_BID

http://secunia.com/advisories/35314
Tags : third-party-advisory, x_refsource_SECUNIA

https://www.exploit-db.com/exploits/8934
Tags : exploit, x_refsource_EXPLOIT-DB

http://redpig.dataspill.org/2009/05/drive-by-attack-for-itunes-811.html
Tags : x_refsource_MISC

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17099
Tags : vdb-entry, signature, x_refsource_OVAL

https://www.exploit-db.com/exploits/8861
Tags : exploit, x_refsource_EXPLOIT-DB

http://support.apple.com/kb/HT3592
Tags : x_refsource_CONFIRM

http://www.securityfocus.com/archive/1/504043/100/0/threaded
Tags : mailing-list, x_refsource_BUGTRAQ

http://static.dataspill.org/releases/itunes/itms_overflow.rb
Tags : x_refsource_MISC

http://osvdb.org/54833
Tags : vdb-entry, x_refsource_OSVDB

https://exchange.xforce.ibmcloud.com/vulnerabilities/50899
Tags : vdb-entry, x_refsource_XF

http://lists.apple.com/archives/security-announce/2009/Jun/msg00001.html
Tags : vendor-advisory, x_refsource_APPLE

http://www.securitytracker.com/id?1022313
Tags : vdb-entry, x_refsource_SECTRACK

Tanggal	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	73.65%	–	–
2022-07-17	–	–	66.56%	–	–
2022-07-24	–	–	73.65%	–	–
2023-03-12	–	–	–	97.21%	–
2023-07-23	–	–	–	97.11%	–
2023-09-10	–	–	–	96.57%	–
2023-10-22	–	–	–	96.4%	–
2023-12-03	–	–	–	96.29%	–
2024-01-14	–	–	–	96.6%	–
2024-02-25	–	–	–	96.78%	–
2024-04-07	–	–	–	96.88%	–
2024-06-02	–	–	–	96.8%	–
2024-06-16	–	–	–	96.6%	–
2024-07-28	–	–	–	96.33%	–
2024-09-01	–	–	–	96.27%	–
2024-09-29	–	–	–	96.1%	–
2024-12-15	–	–	–	95.84%	–
2024-12-22	–	–	–	95.87%	–
2025-01-19	–	–	–	95.7%	–
2025-01-19	–	–	–	95.7%	–
2025-02-23	–	–	–	95.64%	–
2025-02-23	–	–	–	95.64%	–
2025-03-18	–	–	–	–	82.11%

Tanggal	Persentil
2022-02-06	99%
2022-07-17	99%
2022-07-24	99%
2023-03-12	1%
2023-07-23	1%
2023-09-10	99%
2023-10-22	99%
2023-12-03	99%
2024-01-14	1%
2024-02-25	1%
2024-04-07	1%
2024-06-02	1%
2024-06-16	1%
2024-07-28	1%
2024-09-01	1%
2024-09-29	1%
2024-12-15	1%
2024-12-22	1%
2025-01-19	1%
2025-01-19	1%
2025-02-23	1%
2025-02-23	1%
2025-03-18	99%

CVE-2009-0950 : Detail

CVE-2009-0950