Description
Apple iTunes before 8.1 does not properly inform the user about the origin of an authentication request, which makes it easier for remote podcast servers to trick a user into providing a username and password when subscribing to a crafted podcast.
References
- 1021843 vdb-entry
- 34094 vdb-entry
- 52579 vdb-entry
- oval:org.mitre.oval:def:5336 vdb-entry signature
- ADV-2009-0702 vdb-entry
- 34254 third-party-advisory
- APPLE-SA-2009-03-11 vendor-advisory
- http://support.apple.com/kb/HT3487
- itunes-podcast-information-disclosure(49201) vdb-entry