Shulou(Shulou.com)11/24 Report--

CTOnews.com June 2, Apple officially released an update of iTunes version 12.12.9 for Win10 and Win11 on May 23, focusing on fixing rights loopholes and recommending users to install them as soon as possible.

According to a press release issued on Apple's website, malware can escalate its privileges through a vulnerability on iTunes to install malware on Win10 and Win11 devices. Apple fixed the vulnerability in its iTunes update released last week, and the security company that discovered it, Synopsys, shared more details today.

According to the report, CTOnews.com briefly describes the details of the vulnerability as follows:

Previously, there was a vulnerability in the permission control of folders in the PC version of iTunes, which allowed attackers to create folders that were redirected to the Windows system directory, which could be used to gain higher privileges on the system shell.

The iTunes application creates a folder SC Info as the system user in the C:\ ProgramData\ Apple Computer\ iTunes directory and grants full control of this directory to all users.

Users running iTunes applications can delete the SC Info folder, create a link to the Windows system folder, and recreate it by forcing MSI repair, which can later be used to gain Windows SYSTEM-level access.

Synopsys first discovered the problem in September 2022 and told Apple about it at the time. Apple identified the vulnerability in November last year and fixed it in May.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.