{"id":26065,"date":"2014-05-19T10:18:02","date_gmt":"2014-05-19T17:18:02","guid":{"rendered":"http:\/\/www.intego.com\/mac-security-blog\/?p=26065"},"modified":"2014-05-19T10:19:49","modified_gmt":"2014-05-19T17:19:49","slug":"apple-releases-itunes-11-2-1-fixes-itunes-11-2-security-bug","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/apple-releases-itunes-11-2-1-fixes-itunes-11-2-security-bug\/","title":{"rendered":"Apple Releases iTunes 11.2.1 \u2013 Fixes iTunes 11.2 Security Bug"},"content":{"rendered":"

Last week on Thursday, Apple released an iTunes update to version 11.2 in conjunction with an updated version of Mac OS X<\/a>. Then on Friday, Apple rolled out iTunes 11.2.1 as an emergency update, after the previous version mistakenly opened a serious security hole on Apple Macs<\/a>. Apparently, after updating to iTunes 11.2, Mac users began noticing that their Users and \/Users\/Shared folders were missing, vanished upon reboot.<\/p>\n

Apple’s iTunes 11.2.1 update is available for Mac OS X 10.6.8 or later.<\/p>\n

\"iTunes<\/a><\/p>\n

Apple’s first update on Thursday, iTunes 11.2<\/a>, addressed the following vulnerability:<\/p>\n

CVE-2014-1296<\/a> :\u00a0An attacker in a privileged network position can obtain iTunes credentials.\u00a0Set-Cookie HTTP headers would be processed even if the connection closed before the header line was complete. An attacker could strip security settings from the cookie by forcing the connection to close before the security settings were sent, and then obtain the value of the unprotected cookie. This issue was addressed by ignoring incomplete HTTP header lines.<\/p><\/blockquote>\n

The update, however, opened a serious security hole for users who have multiple accounts on their Macs.\u00a0As Graham Cluley mentioned on his blog<\/a>, the flaw affects users who have multiple accounts on their Macs, and he pointed out, “In an environment where a number of people might be sharing the same computer that\u2019s not good news at all.”<\/p>\n

Apple explained<\/a> that those affected by the flaw would see the following symptoms:<\/p>\n

\n

The folders listed below\u00a0might appear to be missing after installing iTunes 11.2 on OS X Mavericks. This can happen if you have Find My Mac enabled in iCloud System Preferences.<\/p>\n

Folders affected:<\/p>\n