Apple iCloud up to 7.10 on Windows iTunes race condition

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Apple iCloud up to 7.10 on Windows. This vulnerability affects unknown code of the component iTunes. Performing a manipulation results in race condition. This vulnerability is cataloged as CVE-2019-6232. The attack must be initiated from a local position. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Apple iCloud up to 7.10 on Windows (Cloud Software). This affects an unknown functionality of the component iTunes. The manipulation with an unknown input leads to a race condition vulnerability. CWE is classifying the issue as CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A race condition existed during the installation of iTunes for Windows. This was addressed with improved state handling. This issue is fixed in iCloud for Windows 7.11. Running the iTunes installer in an untrusted directory may result in arbitrary code execution.

The bug was discovered 03/25/2019. The weakness was shared 03/25/2019 by Stefan Kanthak as HT209605 as confirmed advisory (Website). It is possible to read the advisory at support.apple.com. This vulnerability is uniquely identified as CVE-2019-6232 since 01/11/2019. Attacking locally is a requirement. The successful exploitation needs a authentication. The technical details are unknown and an exploit is not publicly available. The advisory points out:

A race condition existed during the installation of iTunes for Windows. This was addressed with improved state handling.

The commercial vulnerability scanner Qualys is able to test this issue with plugin 371708 (Apple iCloud for Windows Prior to 7.11 Multiple Vulnerabilities(HT209605)).

Upgrading to version 7.11 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The entries VDB-132236, VDB-132243, VDB-132286 and VDB-132290 are related to this item. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Cloud Software

Vendor

• Apple

Name

• iCloud

Version

• 7.0
• 7.1
• 7.2
• 7.3
• 7.4
• 7.5
• 7.6
• 7.7
• 7.8
• 7.9
• 7.10

License

• free

Website

• Vendor: https://www.apple.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion