0

I've been reading about the infamous "goto fail" security bug in iOS 6 and OS X 10.9, but I haven't read anything about whether other Apple software, like for example iTunes for Windows, is affected. This is relevant since, after all, iTunes is the software you use to access your Apple account and update your credit card information.

Since I haven't read anything about it, I assume that it isn't affected... but am I wrong? Has anyone tried verifying whether iTunes is safe?

  • What version of Windows and iTunes are you running? – bmike Mar 9 '14 at 16:07
3

The "goto fail" bug was part of a OS X library that checked that a valid SSL certificate also matched the host records it was exchanging traffic with.

Since many applications use SSL first identify a web site securely and then encrypt the traffic, having the library in the core OS lets each program not have to do the work to validate a cert. By patching/fixing this library the problem is solved for all applications that relied on that fucntion.

On OS X, iTuned relied on the system to validate SSL certs and thus didn't need a patch. There isn't a published vulnerability listed (yet) for iTunes for Windows, so you should be in the clear for that one issue.

Of course iTunes could have other security issues that aren't published or patched yet, but there's not any evidence that Windows iTunes is vulnerable today to the same code problem.

  • So I take it that iTunes for Windows shouldn't be affected by that bug, right? – PaulJ Mar 9 '14 at 14:16
  • Right, that bug was OS X-only – nohillside Mar 9 '14 at 14:18
  • Is that fixed with 10.9.2 ? – Ruskes Mar 9 '14 at 14:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .